Malicious
Malicious

be80e4ad31713506dc6c7b27c9399137

PE Executable
|
MD5: be80e4ad31713506dc6c7b27c9399137
|
Size: 1.92 MB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
be80e4ad31713506dc6c7b27c9399137
Sha1
b09a6dd21fbce30c11eba0d8bc60f8cdeabdb430
Sha256
3b2d418e9f84aa474b761ba5101b7feea4d98e68f55f65eec5b6e04a6cce27e6
Sha384
b388f027a0cb3f7cde549c7ab7d1741040423ed2ae4d4f682dfd95baee263ad4c5eb1b52a4232f23d14059b4878f329f
Sha512
24c4d210248168224dc0a0d7ca26b57b2dcc4e65d065ed8ae667eb31ac879cabc52305cd2d246ee73e022bc70a6f37fbd8fff0eea87f958f103cd4bdf8cc6b1c
SSDeep
24576:hhNBYIyi9x5iEPqYd1iFdqQMSX3SKaEy9ZvATjbOKSvLLiOGQ33myUM0fqCEj5/:hGIySivQK3JnaH59YMcqCEj5
TLSH
1495AE56AAE14F32C3745732959B023E9290C7363616EF0B399F54D26C07BF18EB61A3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
be80e4ad31713506dc6c7b27c9399137
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
bHDMNyHgoeufX3ueaa.6evBtOPoiRGJNdbLlf
lOfbPQpShhQlMWSl9c.TZUtoLfiQ14MmiXAKm
aWWBwB3J5i7Y67xJhX.Sx0GmmvW4P9wTJs8Jt
xU8jhbGjlJNd8ZJ23N.uPht8vWTUKHlZdZPsC
MQ7CDqURIj1Xj6Ouu5.7cJJWaxynS07qMvxUj
fw1igakAGak8rJGpos.7GDBwJ84FnM7GX2CUj
Informations
Name
 Value
Module Name

pxqDsBPmp0nY
Full Name

pxqDsBPmp0nY
EntryPoint

System.Void HvoeKA4W2OfgwtElvjk.mB3m0e4GhZZLp4RXBkO::lA443FtVWj()
Scope Name

pxqDsBPmp0nY
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version

4.1.5.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

47
Main Method

System.Void HvoeKA4W2OfgwtElvjk.mB3m0e4GhZZLp4RXBkO::lA443FtVWj()
Main IL Instruction Count

43
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0030: newobj System.Void MuPqSppxr0ZUFhyFqhQ.sGvtEopUfH5IXEyndXr::.ctor() newobj System.Void MuPqSppxr0ZUFhyFqhQ.sGvtEopUfH5IXEyndXr::.ctor() pop <null> ldc.i4 4 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ret <null> call System.Void Yk0JHblcp1giqIUNnKy.FMyJbhl2rTggaXM8iqy::Vcm8pr9Fbxo() ldc.i4 0 ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_21aa9efef71f4cb1839a1f183e27df12 brfalse IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ldnull <null> ldnull <null> newobj System.Void p8S9D0WaOCjv5lYljDX.AoJYDLWu2MDP2LLhpsv::.ctor(System.String,System.String) call System.Void nQjPP88CFDjNySWnYU0.uJLRDG84dfnmcB0jMxO::m9y8I3f9Nc(p8S9D0WaOCjv5lYljDX.AoJYDLWu2MDP2LLhpsv) ldc.i4 2 ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_803a3e35ed8e4064a7af2140a094e690 brfalse IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ldc.i4 5329734 ldc.i4 4 shr <null> ldc.i4 2053835931 xor <null> ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_19b81f31951148fd90c39d61729a7e5e xor <null> call System.String c5S2LZN2TeI3WUpNy6o.B8f7mwNRRsAISjCNksf::Bv4NXCJrbV(System.Int32) newobj System.Void kvo9KyfHryGyavhX3ql.JtY1wBfx1wKY0ZPhol3::.ctor(System.String) call System.Void kvo9KyfHryGyavhX3ql.JtY1wBfx1wKY0ZPhol3::F66fP6uhLn() ldc.i4 3 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065)
Module Name

pxqDsBPmp0nY
Full Name

pxqDsBPmp0nY
EntryPoint

System.Void HvoeKA4W2OfgwtElvjk.mB3m0e4GhZZLp4RXBkO::lA443FtVWj()
Scope Name

pxqDsBPmp0nY
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version

4.1.5.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

47
Main Method

System.Void HvoeKA4W2OfgwtElvjk.mB3m0e4GhZZLp4RXBkO::lA443FtVWj()
Main IL Instruction Count

43
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0030: newobj System.Void MuPqSppxr0ZUFhyFqhQ.sGvtEopUfH5IXEyndXr::.ctor() newobj System.Void MuPqSppxr0ZUFhyFqhQ.sGvtEopUfH5IXEyndXr::.ctor() pop <null> ldc.i4 4 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ret <null> call System.Void Yk0JHblcp1giqIUNnKy.FMyJbhl2rTggaXM8iqy::Vcm8pr9Fbxo() ldc.i4 0 ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_21aa9efef71f4cb1839a1f183e27df12 brfalse IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ldnull <null> ldnull <null> newobj System.Void p8S9D0WaOCjv5lYljDX.AoJYDLWu2MDP2LLhpsv::.ctor(System.String,System.String) call System.Void nQjPP88CFDjNySWnYU0.uJLRDG84dfnmcB0jMxO::m9y8I3f9Nc(p8S9D0WaOCjv5lYljDX.AoJYDLWu2MDP2LLhpsv) ldc.i4 2 ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_803a3e35ed8e4064a7af2140a094e690 brfalse IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) pop <null> ldc.i4 0 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065) ldc.i4 5329734 ldc.i4 4 shr <null> ldc.i4 2053835931 xor <null> ldsfld <Module>{f0e16379-f522-4903-8b12-1e1b7454076c} <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_95312e17045641ef9b1a2ec65c366f12 ldfld System.Int32 <Module>{f0e16379-f522-4903-8b12-1e1b7454076c}::m_19b81f31951148fd90c39d61729a7e5e xor <null> call System.String c5S2LZN2TeI3WUpNy6o.B8f7mwNRRsAISjCNksf::Bv4NXCJrbV(System.Int32) newobj System.Void kvo9KyfHryGyavhX3ql.JtY1wBfx1wKY0ZPhol3::.ctor(System.String) call System.Void kvo9KyfHryGyavhX3ql.JtY1wBfx1wKY0ZPhol3::F66fP6uhLn() ldc.i4 3 br IL_0012: switch(IL_0030,IL_0041,IL_0090,IL_0040,IL_0065)
be80e4ad31713506dc6c7b27c9399137 (1.92 MB)
File Structure
be80e4ad31713506dc6c7b27c9399137
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
bHDMNyHgoeufX3ueaa.6evBtOPoiRGJNdbLlf
lOfbPQpShhQlMWSl9c.TZUtoLfiQ14MmiXAKm
aWWBwB3J5i7Y67xJhX.Sx0GmmvW4P9wTJs8Jt
xU8jhbGjlJNd8ZJ23N.uPht8vWTUKHlZdZPsC
MQ7CDqURIj1Xj6Ouu5.7cJJWaxynS07qMvxUj
fw1igakAGak8rJGpos.7GDBwJ84FnM7GX2CUj
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙