Malicious PE Executable analysis – ab8d2432d8c3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXEab8d2432d8c31d8e6c1cae8fbb50f50d

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Zqtbh.exe
Full Name	Zqtbh.exe
EntryPoint	System.Void TQ0OXAbFJmio1PHdU3.wJPW3PKH3624NQ3rnu::iVspO1OcE()
Scope Name	Zqtbh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zqtbh
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void TQ0OXAbFJmio1PHdU3.wJPW3PKH3624NQ3rnu::iVspO1OcE()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0009: ldloc V_2 br IL_002E: nop ret <null> nop <null> newobj System.Void Td7KYMTdeYZEhCnCnP.Eyr5YixrRCjj1TZwKH::.ctor() ldsfld YjYkPjlpruqkCe90TUw YjYkPjlpruqkCe90TUw::gmplDWAIly call System.Boolean YjYkPjlpruqkCe90TUw::QYnlljWVjW(System.Object,YjYkPjlpruqkCe90TUw) brtrue IL_0096: leave IL_002D ldc.i4 4 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_d846d8839f974e9f9fce999f66384cac brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0070: ldloc V_1 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 1 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_b1bb202fb9944f269ae078546f5f05c8 brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 0 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00C9: ldloc V_0 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_71926c0192ca4ff3b3b5aa7e4abea4c2 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Zqtbh.exe
Full Name	Zqtbh.exe
EntryPoint	System.Void TQ0OXAbFJmio1PHdU3.wJPW3PKH3624NQ3rnu::iVspO1OcE()
Scope Name	Zqtbh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zqtbh
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void TQ0OXAbFJmio1PHdU3.wJPW3PKH3624NQ3rnu::iVspO1OcE()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0009: ldloc V_2 br IL_002E: nop ret <null> nop <null> newobj System.Void Td7KYMTdeYZEhCnCnP.Eyr5YixrRCjj1TZwKH::.ctor() ldsfld YjYkPjlpruqkCe90TUw YjYkPjlpruqkCe90TUw::gmplDWAIly call System.Boolean YjYkPjlpruqkCe90TUw::QYnlljWVjW(System.Object,YjYkPjlpruqkCe90TUw) brtrue IL_0096: leave IL_002D ldc.i4 4 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_d846d8839f974e9f9fce999f66384cac brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0070: ldloc V_1 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 1 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_b1bb202fb9944f269ae078546f5f05c8 brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 0 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00C9: ldloc V_0 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{7705dacb-ef70-4674-aa7f-b789678354fa} <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_bad1bd419e444d54b256992fac423d71 ldfld System.Int32 <Module>{7705dacb-ef70-4674-aa7f-b789678354fa}::m_71926c0192ca4ff3b3b5aa7e4abea4c2 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)