Malicious PE Executable analysis – a999e24ebfc6

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLPe123 v2006.4.4-4.12

Symbol obfuscation

Very high

1 malicious · 6 files

EXEa999e24ebfc6351a425875969eb59e46

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	tmpFRCS851290145updater.exe
Full Name	tmpFRCS851290145updater.exe
EntryPoint	System.Void STTkdxiPLiRQUljtSw.DpOaSl621RAhp3qfAn::Y1C7PReSU()
Scope Name	tmpFRCS851290145updater.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tmpFRCS851290145updater
Assembly Version	136.6035.153.954
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	39
Main Method	System.Void STTkdxiPLiRQUljtSw.DpOaSl621RAhp3qfAn::Y1C7PReSU()
Main IL Instruction Count	37
Main IL	ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0049: newobj System.Void Hf4go0ygWfjk.Jf4fhXso0P::.ctor() ldc.i4.0 <null> ldsfld tcJLyY8A2Q4vUhRuko2 tcJLyY8A2Q4vUhRuko2::ORB8cHIbZs call System.Void tcJLyY8A2Q4vUhRuko2::IV7eISqUhU(System.Boolean,tcJLyY8A2Q4vUhRuko2) ldc.i4 4 br IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) newobj System.Void Hf4go0ygWfjk.Jf4fhXso0P::.ctor() ldsfld g6IMWi8xcHkpyN0MjCp g6IMWi8xcHkpyN0MjCp::BvL8J10i2w call System.Void g6IMWi8xcHkpyN0MjCp::IV7eISqUhU(System.Windows.Forms.Form,g6IMWi8xcHkpyN0MjCp) ldc.i4 3 br IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) call System.Void MugT20y6H7jBsQi2Ykl.DypkflykEGGVtfljhb2::Pvo94uc0hO() ldc.i4 0 ldsfld <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e} <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e}::m_7ea0169030644bcdad93b59a70c0e32e ldfld System.Int32 <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e}::m_985e6ea585474be0a84fcc7c99e1ec72 brfalse IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) pop <null> ldc.i4 0 br IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) call System.Void cEneisyIa7uhAgDGWlw.o0L8I9yOeJtBdEtEGFN::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 1 ldsfld <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e} <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e}::m_7ea0169030644bcdad93b59a70c0e32e ldfld System.Int32 <Module>{847a816e-489e-4a74-9d7f-6cc6609e248e}::m_ce43d8189808464fb456398ee9e6e730 brfalse IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) pop <null> ldc.i4 1 br IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) ldsfld fiuef48VghdqaaUbclN fiuef48VghdqaaUbclN::tV485NhpJa call System.Void fiuef48VghdqaaUbclN::IV7eISqUhU(fiuef48VghdqaaUbclN) ldc.i4 5 br IL_0012: switch(IL_0049,IL_00AA,IL_0086,IL_00BE,IL_0062,IL_0034) ret <null>