Suspicious
Suspect

PE Executable
MD5: bb69e269b18f61d0bd754d4e3234e648
Size: 713.73 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 bb69e269b18f61d0bd754d4e3234e648
Sha1 c6ce96d62b059b99ccc098a2c4f9af7fc9e9d42d
Sha256 426fd8cbda5097fbd159476c10aaea55508712928bfcc765fe6b423b57b545f6
Sha384 e5fe62c264e069e7425acdef34917bf9bbf397d966b013c20436d730eaca104e40c0eb67503ee031fcd2ba037f5ea311
Sha512 1a21a53b09e17c83bf03dfcffadab6dc3fb0921b3292e94aab30de39f9c1c48c98eb3068ce692aed5e043b8d44afa73db2f6ac2f723910706bd0f9e7e8125b7b
SSDeep 12288:Y/HWUjNF1rfQ9vpF2cCCDPsvGMgqzumbxFIs:YF1rI9hNCAPsvH195
TLSH 6CE4AD002BEF4F48E4FAAB386D3552114BF0F80EC736D69E6DD446DE2962BA08B51753
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
bb69e269b18f61d0bd754d4e3234e648
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Elaruneorlith.PolicyData.json
Enp70Tqdx.g.resources
Enp70Tqdx.Resources.resources
babyfondolaga
[NBF]root.IconData
7b490ad596c1ef.Resources.resources
b797bd940
[NBF]root.Data
b797bd941
[NBF]root.Data
b797bd942
[NBF]root.Data
b797bd943
[NBF]root.Data
b797bd944
[NBF]root.Data
b797bd945
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Enp70Tqdx
Full Name
Enp70Tqdx
EntryPoint
System.Void Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::kWr4Z8pg()
Scope Name
Enp70Tqdx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Enp70Tqdx
Assembly Version
5.2.22.109
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1138
Main Method
System.Void Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::kWr4Z8pg()
Main IL Instruction Count
107
Main IL 
nop <null>
nop <null>
ldstr System Configuration Manager
stloc.0 <null>
ldstr 1.2.0
stloc.1 <null>
call System.String System.Environment::get_UserName()
callvirt System.String System.String::ToLower()
ldstr admin
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0033: ldc.i4.1
call System.String System.Environment::get_MachineName()
callvirt System.Int32 System.String::get_Length()
ldc.i4.3 <null>
cgt <null>
br.s IL_0034: stloc.3
ldc.i4.1 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_003B: nop
nop <null>
br.s IL_0044: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_007E: nop
nop <null>
leave.s IL_007C: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007C: nop
nop <null>
nop <null>
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SysConfig
ldstr policy.dat
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00A3: nop
nop <null>
nop <null>
call System.Boolean Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::9beKoTc81znGk()
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_00BA: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 60
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
call System.Void Enp70Tqdx.fs4Ea3FkXp::5wgJqF3cknX2()
nop <null>
leave.s IL_00F2: leave.s IL_010D
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
ldstr Application failed to start: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Enp70Tqdx.fs4Ea3FkXp::wAr6j1Hq5Tbo(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F2: leave.s IL_010D
leave.s IL_010D: nop
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
leave.s IL_010B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010B: nop
nop <null>
endfinally <null>
nop <null>
ret <null>
Module Name
Enp70Tqdx
Full Name
Enp70Tqdx
EntryPoint
System.Void Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::kWr4Z8pg()
Scope Name
Enp70Tqdx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Enp70Tqdx
Assembly Version
5.2.22.109
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1138
Main Method
System.Void Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::kWr4Z8pg()
Main IL Instruction Count
107
Main IL 
nop <null>
nop <null>
ldstr System Configuration Manager
stloc.0 <null>
ldstr 1.2.0
stloc.1 <null>
call System.String System.Environment::get_UserName()
callvirt System.String System.String::ToLower()
ldstr admin
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0033: ldc.i4.1
call System.String System.Environment::get_MachineName()
callvirt System.Int32 System.String::get_Length()
ldc.i4.3 <null>
cgt <null>
br.s IL_0034: stloc.3
ldc.i4.1 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_003B: nop
nop <null>
br.s IL_0044: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_007E: nop
nop <null>
leave.s IL_007C: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007C: nop
nop <null>
nop <null>
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SysConfig
ldstr policy.dat
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00A3: nop
nop <null>
nop <null>
call System.Boolean Enp70Tqdx.fs4Ea3FkXp/7boJG9kxxBj.qz0TAnr3::9beKoTc81znGk()
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_00BA: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 60
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
call System.Void Enp70Tqdx.fs4Ea3FkXp::5wgJqF3cknX2()
nop <null>
leave.s IL_00F2: leave.s IL_010D
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
ldstr Application failed to start: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Enp70Tqdx.fs4Ea3FkXp::wAr6j1Hq5Tbo(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F2: leave.s IL_010D
leave.s IL_010D: nop
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
leave.s IL_010B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010B: nop
nop <null>
endfinally <null>
nop <null>
ret <null>
bb69e269b18f61d0bd754d4e3234e648
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Elaruneorlith.PolicyData.json
Enp70Tqdx.g.resources
Enp70Tqdx.Resources.resources
babyfondolaga
[NBF]root.IconData
7b490ad596c1ef.Resources.resources
b797bd940
[NBF]root.Data
b797bd941
[NBF]root.Data
b797bd942
[NBF]root.Data
b797bd943
[NBF]root.Data
b797bd944
[NBF]root.Data
b797bd945
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙