Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: c05baf1f365887eabbaa5432bbb0f73a
Size: 643.58 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c05baf1f365887eabbaa5432bbb0f73a
Sha1 541b592eb3032326ee15d1d863c370444d1e3eb9
Sha256 83b5c8aa802986507b5bc678c4839256df06f5fc71a155fb164e2a09c0b22fd5
Sha384 e77eb3c2275b38058792e41e52340d97d94498216fd316264e335ffd6776ad93d70ac4a83204f6e87bed024f72a3951c
Sha512 c71a08c13a12cd7eccbb0bf31bca8f9df51ab343db1f8155bc3fdeb1404427b46357276e0197765f07e2c999469c0800bea9cca80265fbe4d3b428b6848f98c5
SSDeep 12288:6waJH3htpQ9jQ4xOV3KTXvLISHHcPIC8BaGiDyU:8ftpQ9jQ4xOV3KDjIGcPIPBhOy
TLSH D8D4AEBB76534E22D2840337C5C7484193BDD78676A7F30E748413A66A033BADE4B6A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c05baf1f365887eabbaa5432bbb0f73a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
q6GrljIonYek2K3Wwo.2PNHL9qPtjRdy63iU7
YDGOJQxRZw0VkNh03o.sXZ2RKXUhxnthteDmh
Stuil.g.resources
Fa2p2J0HRGqFA57L2v.asajc4OoPUeduPBHNb
Qfkgpa.Properties.Resources.resources
Tljasdi
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Stuil.exe
Full Name
Stuil.exe
EntryPoint
System.Void Vo323bDpBjThsmGSMC.lkXoYZLQOFLKbsrKpx::di9H6f9vu()
Scope Name
Stuil.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stuil
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Vo323bDpBjThsmGSMC.lkXoYZLQOFLKbsrKpx::di9H6f9vu()
Main IL Instruction Count
118
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: nop
nop <null>
newobj System.Void KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M::.ctor()
stloc.s V_4
ldc.i4 4
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
br IL_004D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 12
beq IL_008B: newobj System.Void W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR::.ctor()
ldloc V_2
ldc.i4 992
beq IL_004D: ldloc V_2
br IL_0178: newobj System.Void PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9::.ctor()
newobj System.Void W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR::.ctor()
stloc.s V_3
ldc.i4 0
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_00bf8f9f638f45dab21d89331bf27fa7
brtrue IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 1
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void vB7gwT1IsUJ7ZkOY9M.FLjTN25LVqClU24ORT::.ctor()
dup <null>
dup <null>
ldsfld m8xqBYOBLDvE07HsawJ m8xqBYOBLDvE07HsawJ::yMTOPBcm2P
call System.Void m8xqBYOBLDvE07HsawJ::X29OuWhbsD(System.Object,vB7gwT1IsUJ7ZkOY9M.FLjTN25LVqClU24ORT,m8xqBYOBLDvE07HsawJ)
dup <null>
ldloc.s V_3
ldsfld WHhMD4OYADLDl8HoCdb WHhMD4OYADLDl8HoCdb::wGbOvtdr16
call System.Void WHhMD4OYADLDl8HoCdb::X29OuWhbsD(System.Object,W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR,WHhMD4OYADLDl8HoCdb)
ldloc.s V_3
ldloc.s V_4
ldsfld l8QxlcOyY7HjEIVgfRS l8QxlcOyY7HjEIVgfRS::FU9OQ6cima
call System.Void l8QxlcOyY7HjEIVgfRS::X29OuWhbsD(System.Object,KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M,l8QxlcOyY7HjEIVgfRS)
ldloc.s V_3
ldloc.s V_6
ldsfld TR7PvFOl8PhuSc0N6mL TR7PvFOl8PhuSc0N6mL::iaqOedE2CK
call System.Void TR7PvFOl8PhuSc0N6mL::X29OuWhbsD(System.Object,SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1,TR7PvFOl8PhuSc0N6mL)
ldloc.s V_3
ldloc.s V_5
ldsfld RGh3NAOZiSJ08hTjDcx RGh3NAOZiSJ08hTjDcx::tKROWrOnI4
call System.Void RGh3NAOZiSJ08hTjDcx::X29OuWhbsD(System.Object,PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9,RGh3NAOZiSJ08hTjDcx)
ldloc.s V_5
ldloc.s V_6
ldsfld zOROKFOFOcrFX1QTyp9 zOROKFOFOcrFX1QTyp9::bwHOijhWpy
call System.Void zOROKFOFOcrFX1QTyp9::X29OuWhbsD(System.Object,SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1,zOROKFOFOcrFX1QTyp9)
ldloc.s V_6
ldloc.s V_4
ldsfld NNhbJhOGKUwJcoYUBxc NNhbJhOGKUwJcoYUBxc::BOyOU9nGtv
call System.Void NNhbJhOGKUwJcoYUBxc::X29OuWhbsD(System.Object,KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M,NNhbJhOGKUwJcoYUBxc)
ldsfld MPRf1KO786obWp4tiSs MPRf1KO786obWp4tiSs::mvNOT8mxHP
call System.Boolean MPRf1KO786obWp4tiSs::X29OuWhbsD(System.Object,MPRf1KO786obWp4tiSs)
brfalse IL_0189: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 1
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_6a2b79f2d26f48829988099cb7dcc1d5
brfalse IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 6
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1::.ctor()
stloc.s V_6
ldc.i4 11
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_983ed78a19c14852b1701dc60bcde325
brtrue IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 3
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
br IL_018F: leave IL_0206
ldc.i4 2
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9::.ctor()
stloc.s V_5
ldc.i4 12
br IL_0049: stloc V_2
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0206: ret
pop <null>
ldc.i4 1
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_7f90c1a25d7a4f769bba576eac579df9
brtrue IL_01C6: switch(IL_01E2)
pop <null>
ldc.i4 0
br IL_01C6: switch(IL_01E2)
br IL_01C2: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_01C2: ldloc V_0
br IL_01E2: leave IL_0206
leave IL_0206: ret
ldc.i4 0
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_fe4c0c479322443fabb2828b05707036
brtrue IL_000D: switch(IL_0206,IL_002D)
pop <null>
ldc.i4 4
br IL_000D: switch(IL_0206,IL_002D)
ret <null>
Module Name
Stuil.exe
Full Name
Stuil.exe
EntryPoint
System.Void Vo323bDpBjThsmGSMC.lkXoYZLQOFLKbsrKpx::di9H6f9vu()
Scope Name
Stuil.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stuil
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Vo323bDpBjThsmGSMC.lkXoYZLQOFLKbsrKpx::di9H6f9vu()
Main IL Instruction Count
118
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: nop
nop <null>
newobj System.Void KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M::.ctor()
stloc.s V_4
ldc.i4 4
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
br IL_004D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 12
beq IL_008B: newobj System.Void W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR::.ctor()
ldloc V_2
ldc.i4 992
beq IL_004D: ldloc V_2
br IL_0178: newobj System.Void PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9::.ctor()
newobj System.Void W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR::.ctor()
stloc.s V_3
ldc.i4 0
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_00bf8f9f638f45dab21d89331bf27fa7
brtrue IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 1
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void vB7gwT1IsUJ7ZkOY9M.FLjTN25LVqClU24ORT::.ctor()
dup <null>
dup <null>
ldsfld m8xqBYOBLDvE07HsawJ m8xqBYOBLDvE07HsawJ::yMTOPBcm2P
call System.Void m8xqBYOBLDvE07HsawJ::X29OuWhbsD(System.Object,vB7gwT1IsUJ7ZkOY9M.FLjTN25LVqClU24ORT,m8xqBYOBLDvE07HsawJ)
dup <null>
ldloc.s V_3
ldsfld WHhMD4OYADLDl8HoCdb WHhMD4OYADLDl8HoCdb::wGbOvtdr16
call System.Void WHhMD4OYADLDl8HoCdb::X29OuWhbsD(System.Object,W71knVGZsQT9CZYlJI.CbCXnUikyNC2r20PxR,WHhMD4OYADLDl8HoCdb)
ldloc.s V_3
ldloc.s V_4
ldsfld l8QxlcOyY7HjEIVgfRS l8QxlcOyY7HjEIVgfRS::FU9OQ6cima
call System.Void l8QxlcOyY7HjEIVgfRS::X29OuWhbsD(System.Object,KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M,l8QxlcOyY7HjEIVgfRS)
ldloc.s V_3
ldloc.s V_6
ldsfld TR7PvFOl8PhuSc0N6mL TR7PvFOl8PhuSc0N6mL::iaqOedE2CK
call System.Void TR7PvFOl8PhuSc0N6mL::X29OuWhbsD(System.Object,SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1,TR7PvFOl8PhuSc0N6mL)
ldloc.s V_3
ldloc.s V_5
ldsfld RGh3NAOZiSJ08hTjDcx RGh3NAOZiSJ08hTjDcx::tKROWrOnI4
call System.Void RGh3NAOZiSJ08hTjDcx::X29OuWhbsD(System.Object,PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9,RGh3NAOZiSJ08hTjDcx)
ldloc.s V_5
ldloc.s V_6
ldsfld zOROKFOFOcrFX1QTyp9 zOROKFOFOcrFX1QTyp9::bwHOijhWpy
call System.Void zOROKFOFOcrFX1QTyp9::X29OuWhbsD(System.Object,SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1,zOROKFOFOcrFX1QTyp9)
ldloc.s V_6
ldloc.s V_4
ldsfld NNhbJhOGKUwJcoYUBxc NNhbJhOGKUwJcoYUBxc::BOyOU9nGtv
call System.Void NNhbJhOGKUwJcoYUBxc::X29OuWhbsD(System.Object,KYWWi4vmia8LG3aCM7.Yuo1UpYJXOuFXtNt9M,NNhbJhOGKUwJcoYUBxc)
ldsfld MPRf1KO786obWp4tiSs MPRf1KO786obWp4tiSs::mvNOT8mxHP
call System.Boolean MPRf1KO786obWp4tiSs::X29OuWhbsD(System.Object,MPRf1KO786obWp4tiSs)
brfalse IL_0189: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 1
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_6a2b79f2d26f48829988099cb7dcc1d5
brfalse IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 6
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void SWrO7L6oiN60FZTx3i.UNvAIKw3IYqT5vG0d1::.ctor()
stloc.s V_6
ldc.i4 11
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_983ed78a19c14852b1701dc60bcde325
brtrue IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
pop <null>
ldc.i4 3
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
br IL_018F: leave IL_0206
ldc.i4 2
br IL_0051: switch(IL_00B1,IL_0169,IL_0189,IL_0178,IL_0143)
newobj System.Void PoSBA1KQ64M6JtvpVN.OBnO8o2ohi2pYLlMx9::.ctor()
stloc.s V_5
ldc.i4 12
br IL_0049: stloc V_2
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0206: ret
pop <null>
ldc.i4 1
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_7f90c1a25d7a4f769bba576eac579df9
brtrue IL_01C6: switch(IL_01E2)
pop <null>
ldc.i4 0
br IL_01C6: switch(IL_01E2)
br IL_01C2: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_01C2: ldloc V_0
br IL_01E2: leave IL_0206
leave IL_0206: ret
ldc.i4 0
ldsfld <Module>{805e079b-3595-49f3-bd11-502acefbee91} <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_8ff1711a3f0d474fb0bb063f69bdc1c3
ldfld System.Int32 <Module>{805e079b-3595-49f3-bd11-502acefbee91}::m_fe4c0c479322443fabb2828b05707036
brtrue IL_000D: switch(IL_0206,IL_002D)
pop <null>
ldc.i4 4
br IL_000D: switch(IL_0206,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙