Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 8 files
EXEbe6ef59cc4892779b38ba8386ba1b1ab
Structure
Name Value
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void WB8TIuL9LskN8Y9gASO.qbCLEHLsTYTdrvQXFV7::kblL6pGqjQ()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void WB8TIuL9LskN8Y9gASO.qbCLEHLsTYTdrvQXFV7::kblL6pGqjQ()
Main IL Instruction Count
47
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0044: ldc.i4 619551865
newobj System.Void XqwBNaJCOlbZqWL5rZI.vimmVfJWe3DThaEvD7Z::.ctor()
pop <null>
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldc.i4 619551865
ldc.i4 2073701930
xor <null>
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_9564155e75ee4044bc17b6b8a61adaea
xor <null>
call System.String sandN1rFNmlvZGDPjeB.qt8XaRrn7AIu4OycRND::u43rxqAq8R(System.Int32)
newobj System.Void FptZHwVqpIYiCmLW3DT.JQBpYsVCbSZ8hRk7ofW::.ctor(System.String)
call System.Void FptZHwVqpIYiCmLW3DT.JQBpYsVCbSZ8hRk7ofW::EeUVepiKY2()
ldc.i4 1
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_31a25e414d064948b5ca1d4674bba702
brtrue IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
ldnull <null>
ldnull <null>
newobj System.Void OmP4Fp9MFOQjT5Zp5dg.MZX0Ty9KWBBqGviMIRH::.ctor(System.String,System.String)
call System.Void U3Pb7x1TWgxYPQyURjs.R8gwfX1LnZ656rPkVJW::pTy148VlHP(OmP4Fp9MFOQjT5Zp5dg.MZX0Ty9KWBBqGviMIRH)
ldc.i4 0
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_62b782fd91254458bda175aa98e1b549
brfalse IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
ret <null>
call System.Void X7lghA0gu31yUFEowXk.ClsvKc0FYolHUd0L78T::sR51GD4dxQe()
ldc.i4 1
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_62b782fd91254458bda175aa98e1b549
brtrue IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void WB8TIuL9LskN8Y9gASO.qbCLEHLsTYTdrvQXFV7::kblL6pGqjQ()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void WB8TIuL9LskN8Y9gASO.qbCLEHLsTYTdrvQXFV7::kblL6pGqjQ()
Main IL Instruction Count
47
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0044: ldc.i4 619551865
newobj System.Void XqwBNaJCOlbZqWL5rZI.vimmVfJWe3DThaEvD7Z::.ctor()
pop <null>
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldc.i4 619551865
ldc.i4 2073701930
xor <null>
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_9564155e75ee4044bc17b6b8a61adaea
xor <null>
call System.String sandN1rFNmlvZGDPjeB.qt8XaRrn7AIu4OycRND::u43rxqAq8R(System.Int32)
newobj System.Void FptZHwVqpIYiCmLW3DT.JQBpYsVCbSZ8hRk7ofW::.ctor(System.String)
call System.Void FptZHwVqpIYiCmLW3DT.JQBpYsVCbSZ8hRk7ofW::EeUVepiKY2()
ldc.i4 1
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_31a25e414d064948b5ca1d4674bba702
brtrue IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
ldnull <null>
ldnull <null>
newobj System.Void OmP4Fp9MFOQjT5Zp5dg.MZX0Ty9KWBBqGviMIRH::.ctor(System.String,System.String)
call System.Void U3Pb7x1TWgxYPQyURjs.R8gwfX1LnZ656rPkVJW::pTy148VlHP(OmP4Fp9MFOQjT5Zp5dg.MZX0Ty9KWBBqGviMIRH)
ldc.i4 0
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_62b782fd91254458bda175aa98e1b549
brfalse IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
ret <null>
call System.Void X7lghA0gu31yUFEowXk.ClsvKc0FYolHUd0L78T::sR51GD4dxQe()
ldc.i4 1
ldsfld <Module>{95334fd2-9e01-458a-b5de-d423423ded4d} <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_5a1a4bbc835944b5a0f699f183eddb62
ldfld System.Int32 <Module>{95334fd2-9e01-458a-b5de-d423423ded4d}::m_62b782fd91254458bda175aa98e1b549
brtrue IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0044,IL_0030,IL_00B4,IL_00B3,IL_0088)
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙