Suspicious
Suspect

PE Executable
MD5: b9666747e94c62e5616dd40079632fca
Size: 1.55 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 b9666747e94c62e5616dd40079632fca
Sha1 fcfd0f2b783c38ea63110e911c9495b119bce3d2
Sha256 15c4f381e82e4d4d24ddd1f3ca33cf16678933534da2e5c27f67ec7ece8b7509
Sha384 c95068aa62619d0314631ee30e6e728543db19d957de14bf8d55840cd1741429f07c9f6e43ecb8979e29862a7f4068c9
Sha512 b47b0d2de1ceb1c3da49e9a186c0275a436f3ab850f20cf2b68bfa4e833e9d0a9056174561788509888b1ce07797fe9da5cef99cc1aef04c5c15b0f3ea0d9ee2
SSDeep 24576:bWTrnkxMgmL9aa7Amz1UQoHiTNiBgybwAF+kbIUNfb:sbsa7NBUQoHihUpbwenxN
TLSH 0075235F6C8A46F0C2469A7BCCC78A4153219B2A7267D61E7BCB07BD06A33FF5652103
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b9666747e94c62e5616dd40079632fca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Avfzerrju.Properties.Resources.resources
Mqsbgerrftk
ILRepack.List
Name Value
Module Name
PO 33062831
Full Name
PO 33062831
EntryPoint
System.Void PO33062831.Factories.FactoryCalculator::GenerateTransformableFactory()
Scope Name
PO 33062831
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PO 33062831
Assembly Version
1.0.8202.16329
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void PO33062831.Factories.FactoryCalculator::GenerateTransformableFactory()
Main IL Instruction Count
86
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_00A8: ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ret <null>
ldstr H47L0AAQKUw=
stloc.s V_2
ldc.i4 4
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldsfld System.Func`1<System.Byte[]> PO33062831.Factories.FactoryCalculator/<>c::m_FactoryStrategy
dup <null>
brtrue IL_00BE: newobj System.Void CryptSharp.Core.ObjectAllocator::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldc.i4 0
ldsfld <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d} <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_fcfafa8786f0487aabc0a30dc45525c4
ldfld System.Int32 <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_5290c94416644986886bd904d83981cf
brtrue IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
newobj System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d} <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_fcfafa8786f0487aabc0a30dc45525c4
ldfld System.Int32 <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_bb39c5ccaf754098b540bb6e7370e4c4
brtrue IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldstr KM3x3p0IUKIOt8i7CVq/BQ==
stloc.s V_1
ldc.i4 3
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ldftn System.Byte[] PO33062831.Factories.FactoryCalculator/<>c::CollectFactory()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> PO33062831.Factories.FactoryCalculator/<>c::m_FactoryStrategy
newobj System.Void CryptSharp.Core.ObjectAllocator::.ctor(System.Func`1<System.Byte[]>)
ldloc.s V_0
ldloc.s V_1
ldloc.s V_2
newobj System.Void CryptSharp.Publishing.ConvertiblePublisher::.ctor(System.String,System.String)
stfld CryptSharp.Publishing.ConvertiblePublisher PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::mapTracer
ldloc.s V_0
newobj System.Void CryptSharp.Resolution.ResolverParser::.ctor()
stfld CryptSharp.Resolution.ResolverParser PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::m_ReporterModule
ldloc.s V_0
ldstr lwgW73KmKSX7R3uE0e.QDmViHaLoW63FPKPvh
ldstr T2JRILMWX
newobj System.Void CryptSharp.Publishing.PublisherExplorer::.ctor(System.String,System.String)
stfld CryptSharp.Publishing.PublisherExplorer PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::_MixedAttribute
dup <null>
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateCustomizableFactory(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Core.ObjectAllocator::InstantiateConvertibleObject(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_0
ldfld CryptSharp.Publishing.ConvertiblePublisher PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::mapTracer
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateVirtualFactory(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Publishing.ConvertiblePublisher::LeadPublisher(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_0
ldfld CryptSharp.Resolution.ResolverParser PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::m_ReporterModule
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateExternalFactory(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Resolution.ResolverParser::DecodeCombinedResolver(System.Action`1<System.Reflection.Assembly>)
ldloc.s V_0
ldfld CryptSharp.Publishing.PublisherExplorer PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::_MixedAttribute
ldsfld System.Action PO33062831.Factories.FactoryCalculator/<>c::_LiteralFactory
dup <null>
brtrue IL_0163: callvirt System.Void CryptSharp.Publishing.PublisherExplorer::PublishJoinedPublisher(System.Action)
pop <null>
ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c::CreateVisibleFactory()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action PO33062831.Factories.FactoryCalculator/<>c::_LiteralFactory
callvirt System.Void CryptSharp.Publishing.PublisherExplorer::PublishJoinedPublisher(System.Action)
callvirt System.Void CryptSharp.Core.ObjectAllocator::CompareInternalObject()
ldc.i4 5
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
Module Name
PO 33062831
Full Name
PO 33062831
EntryPoint
System.Void PO33062831.Factories.FactoryCalculator::GenerateTransformableFactory()
Scope Name
PO 33062831
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PO 33062831
Assembly Version
1.0.8202.16329
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void PO33062831.Factories.FactoryCalculator::GenerateTransformableFactory()
Main IL Instruction Count
86
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_00A8: ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ret <null>
ldstr H47L0AAQKUw=
stloc.s V_2
ldc.i4 4
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldsfld System.Func`1<System.Byte[]> PO33062831.Factories.FactoryCalculator/<>c::m_FactoryStrategy
dup <null>
brtrue IL_00BE: newobj System.Void CryptSharp.Core.ObjectAllocator::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldc.i4 0
ldsfld <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d} <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_fcfafa8786f0487aabc0a30dc45525c4
ldfld System.Int32 <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_5290c94416644986886bd904d83981cf
brtrue IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
newobj System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d} <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_fcfafa8786f0487aabc0a30dc45525c4
ldfld System.Int32 <Module>{e64c85e8-9328-4848-b0ee-de2e4e4cc85d}::m_bb39c5ccaf754098b540bb6e7370e4c4
brtrue IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldstr KM3x3p0IUKIOt8i7CVq/BQ==
stloc.s V_1
ldc.i4 3
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ldftn System.Byte[] PO33062831.Factories.FactoryCalculator/<>c::CollectFactory()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> PO33062831.Factories.FactoryCalculator/<>c::m_FactoryStrategy
newobj System.Void CryptSharp.Core.ObjectAllocator::.ctor(System.Func`1<System.Byte[]>)
ldloc.s V_0
ldloc.s V_1
ldloc.s V_2
newobj System.Void CryptSharp.Publishing.ConvertiblePublisher::.ctor(System.String,System.String)
stfld CryptSharp.Publishing.ConvertiblePublisher PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::mapTracer
ldloc.s V_0
newobj System.Void CryptSharp.Resolution.ResolverParser::.ctor()
stfld CryptSharp.Resolution.ResolverParser PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::m_ReporterModule
ldloc.s V_0
ldstr lwgW73KmKSX7R3uE0e.QDmViHaLoW63FPKPvh
ldstr T2JRILMWX
newobj System.Void CryptSharp.Publishing.PublisherExplorer::.ctor(System.String,System.String)
stfld CryptSharp.Publishing.PublisherExplorer PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::_MixedAttribute
dup <null>
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateCustomizableFactory(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Core.ObjectAllocator::InstantiateConvertibleObject(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_0
ldfld CryptSharp.Publishing.ConvertiblePublisher PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::mapTracer
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateVirtualFactory(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Publishing.ConvertiblePublisher::LeadPublisher(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_0
ldfld CryptSharp.Resolution.ResolverParser PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::m_ReporterModule
ldloc.s V_0
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::CreateExternalFactory(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void CryptSharp.Resolution.ResolverParser::DecodeCombinedResolver(System.Action`1<System.Reflection.Assembly>)
ldloc.s V_0
ldfld CryptSharp.Publishing.PublisherExplorer PO33062831.Factories.FactoryCalculator/<>c__DisplayClass0_0::_MixedAttribute
ldsfld System.Action PO33062831.Factories.FactoryCalculator/<>c::_LiteralFactory
dup <null>
brtrue IL_0163: callvirt System.Void CryptSharp.Publishing.PublisherExplorer::PublishJoinedPublisher(System.Action)
pop <null>
ldsfld PO33062831.Factories.FactoryCalculator/<>c PO33062831.Factories.FactoryCalculator/<>c::m_FactoryMonitor
ldftn System.Void PO33062831.Factories.FactoryCalculator/<>c::CreateVisibleFactory()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action PO33062831.Factories.FactoryCalculator/<>c::_LiteralFactory
callvirt System.Void CryptSharp.Publishing.PublisherExplorer::PublishJoinedPublisher(System.Action)
callvirt System.Void CryptSharp.Core.ObjectAllocator::CompareInternalObject()
ldc.i4 5
br IL_0012: switch(IL_00A8,IL_0097,IL_0071,IL_0035,IL_0046,IL_0034)
b9666747e94c62e5616dd40079632fca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Avfzerrju.Properties.Resources.resources
Mqsbgerrftk
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙