Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Portable Executable file
DetectionPeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 10 files
EXEb3f5f77428a0f33f8df042d8655cfbd6PE32 x86
Structure
| Name |
Value |
|---|
| Module Name |
|
| Full Name |
|
| EntryPoint |
System.Void FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::PZfO73Ljo(System.String[]) |
| Scope Name |
|
| Scope Type |
|
| Kind |
|
| Runtime Version |
|
| Tables Header Version |
|
| WinMD Version |
|
| Assembly Name |
|
| Assembly Version |
|
| Assembly Culture |
|
| Has PublicKey |
|
| PublicKey Token |
|
| Target Framework |
.NETFramework,Version=v4.5.2 |
| Total Strings |
|
| Main Method |
System.Void FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::PZfO73Ljo(System.String[]) |
| Main IL Instruction Count |
|
| Main IL |
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
nop <null>
ldc.i4 0
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
stloc.0 <null>
call System.String System.Runtime.InteropServices.RuntimeEnvironment::GetRuntimeDirectory()
ldc.i4 68
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::Byv0Nwceo(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0047: ldc.i4.0
ldloc.2 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
br IL_0048: stloc.3
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_005E: nop
nop <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void XCBNJSD.VZXCGHGHDSF::Execute(System.String,System.Byte[])
nop <null>
nop <null>
br IL_0070: nop
nop <null>
ldc.i4 92
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
nop <null>
leave IL_009B: ret
stloc.s V_4
nop <null>
ldc.i4 150
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
ldloc.s V_4
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_009B: ret
ret <null>
|
| Module Name |
|
| Full Name |
|
| EntryPoint |
System.Void FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::PZfO73Ljo(System.String[]) |
| Scope Name |
|
| Scope Type |
|
| Kind |
|
| Runtime Version |
|
| Tables Header Version |
|
| WinMD Version |
|
| Assembly Name |
|
| Assembly Version |
|
| Assembly Culture |
|
| Has PublicKey |
|
| PublicKey Token |
|
| Target Framework |
.NETFramework,Version=v4.5.2 |
| Total Strings |
|
| Main Method |
System.Void FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::PZfO73Ljo(System.String[]) |
| Main IL Instruction Count |
|
| Main IL |
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
nop <null>
ldc.i4 0
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
stloc.0 <null>
call System.String System.Runtime.InteropServices.RuntimeEnvironment::GetRuntimeDirectory()
ldc.i4 68
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
nop <null>
ldloc.0 <null>
call System.Byte[] FVODZqt9MCNQPWHtBG.ER0eGKscMypM5EEjRB::Byv0Nwceo(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0047: ldc.i4.0
ldloc.2 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
br IL_0048: stloc.3
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_005E: nop
nop <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void XCBNJSD.VZXCGHGHDSF::Execute(System.String,System.Byte[])
nop <null>
nop <null>
br IL_0070: nop
nop <null>
ldc.i4 92
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
nop <null>
leave IL_009B: ret
stloc.s V_4
nop <null>
ldc.i4 150
call System.String MNBslQmrT43HRYfasJ.jMuIkPyJ2PCSb6Gcay::hDI3Ci18g(System.Int32)
ldloc.s V_4
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_009B: ret
ret <null>
|
Embedded Resources
UNKNWOWNsuspect
4huhuhuhu
Suspicious Type Names (1-2 chars)
UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 10 files
EXEb3f5f77428a0f33f8df042d8655cfbd6PE32 x86
Structure
No malware configuration was found at this point.
Embedded Resources
UNKNWOWNsuspect
4huhuhuhu
b3f5f77428a0f33f8df042d8655cfbd6
Suspicious Type Names (1-2 chars)
UNKNWOWN
0huhuhuhu
b3f5f77428a0f33f8df042d8655cfbd6
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
