c1b0bc1cadfc350963dc5b72ddcec4e1
PE Executable | MD5: c1b0bc1cadfc350963dc5b72ddcec4e1 | Size: 575.49 KB | application/x-dosexec
Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | c1b0bc1cadfc350963dc5b72ddcec4e1
|
| Sha1 | 6aa66c089ae6812f701eec32668c4f4c07f76b3f
|
| Sha256 | fa621c1554e0bacc82e3d38037b237907f088f8427bd80f730f60efe9879872f
|
| Sha384 | 195e6c3273f49d36910a8dabe1f5ba98635f7e93b2a2fad40c28b1555c7ad01504df5940c6fc3d017e6942fa51248c24
|
| Sha512 | 57c094c4e16c97b8dc8b69120d9b734e12ac4c4b3d6dddb151f9ce75ddbdd10622d2cb8e0d14b4738e290a302cbcc3b6c697757aaf0ebd028d081364206ef814
|
| SSDeep | 12288:3lkl5SA63hEZR5xC0cRVA/gK6eO0QRbP6xGoX8flt0b4pGeBm2yY1:3lkzSA6RGP0VeqelQ9foC982B
|
| TLSH | F8C402477BC84725D24A9272C4D78E2443FBEACB6277E3467F4212961E413E0CD96B8E
|
PeID
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Vipkxkzfav.exe |
| Full Name | Vipkxkzfav.exe |
| EntryPoint | System.Void YgXtlxfGOjqlR388Wc.jJL32ekysb5FDfVCPv::AlGqIM5fm() |
| Scope Name | Vipkxkzfav.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Vipkxkzfav |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 39 |
| Main Method | System.Void YgXtlxfGOjqlR388Wc.jJL32ekysb5FDfVCPv::AlGqIM5fm() |
| Main IL Instruction Count | 134 |
| Main IL | ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_0009: ldloc V_2 br IL_025C: ldsfld C1HXeKA5fRMyog5aija C1HXeKA5fRMyog5aija::MYWA2H9OaV ret <null> nop <null> ldsfld cgH4iZAD1VsBnAcAbgd cgH4iZAD1VsBnAcAbgd::sp1AriHpiR call System.Byte[] cgH4iZAD1VsBnAcAbgd::jrFApGvyxh(cgH4iZAD1VsBnAcAbgd) stloc.s V_3 ldc.i4 3 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) br IL_0057: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 17 beq IL_00C7: ldloc.s V_3 ldloc V_0 ldc.i4 997 beq IL_0057: ldloc V_0 br IL_00E2: leave IL_0031 br IL_01A9: ldloc.s V_3 ldc.i4 6 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret ldc.i4 4 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brtrue IL_0106: ldloc.s V_3 ldc.i4 7 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret ldc.i4 16 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_19f676d5ce0946ca842fa632d29b042a brtrue IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 5 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld pZViUpAFfcRlMWh5rPQ pZViUpAFfcRlMWh5rPQ::j1dA8iIhVX call System.Void pZViUpAFfcRlMWh5rPQ::jrFApGvyxh(System.Byte[],pZViUpAFfcRlMWh5rPQ) ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_a4c1f12bd8da471dad4712454ac32cac brfalse IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 6 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld WZDNyYATVgdKpwpPAM1 WZDNyYATVgdKpwpPAM1::EIOAC6F12n call System.Byte[] WZDNyYATVgdKpwpPAM1::jrFApGvyxh(System.Byte[],WZDNyYATVgdKpwpPAM1) stloc.s V_3 ldc.i4 2 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_5dd44e8ac9ad458da849853ae45220a1 brtrue IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 16 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brfalse IL_00E2: leave IL_0031 ldc.i4 1 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_d348b703232f4318adefadc3db54fbdf brfalse IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 10 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brtrue IL_0131: ldloc.s V_3 ldc.i4 9 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld Fi8NMTAWX22AbgGk7UU Fi8NMTAWX22AbgGk7UU::kqSAn3qZUT call System.Byte[] Fi8NMTAWX22AbgGk7UU::jrFApGvyxh(System.Byte[],Fi8NMTAWX22AbgGk7UU) stloc.s V_3 ldc.i4 17 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_a3495dbcd331453c8bfed09cd79ba4f8 brfalse IL_0053: stloc V_0 pop <null> ldc.i4 3 br IL_0053: stloc V_0 leave IL_0031: ret ldc.i4 8 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret pop <null> ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_7f7230439b20475d823b1bb0a526fb2e brfalse IL_021C: switch(IL_0238) pop <null> ldc.i4 3 br IL_021C: switch(IL_0238) br IL_0218: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0218: ldloc V_1 br IL_0238: leave IL_0031 leave IL_0031: ret ldc.i4 2 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_cf82a7d511364c7a89f7185753764e98 brtrue IL_000D: switch(IL_0032,IL_025C,IL_0031) pop <null> ldc.i4 1 br IL_000D: switch(IL_0032,IL_025C,IL_0031) ldsfld C1HXeKA5fRMyog5aija C1HXeKA5fRMyog5aija::MYWA2H9OaV call System.Void C1HXeKA5fRMyog5aija::jrFApGvyxh(C1HXeKA5fRMyog5aija) ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_557de8a55e9442959fc32e7d074593f2 brtrue IL_000D: switch(IL_0032,IL_025C,IL_0031) pop <null> ldc.i4 4 br IL_000D: switch(IL_0032,IL_025C,IL_0031) |
| Module Name | Vipkxkzfav.exe |
| Full Name | Vipkxkzfav.exe |
| EntryPoint | System.Void YgXtlxfGOjqlR388Wc.jJL32ekysb5FDfVCPv::AlGqIM5fm() |
| Scope Name | Vipkxkzfav.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Vipkxkzfav |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 39 |
| Main Method | System.Void YgXtlxfGOjqlR388Wc.jJL32ekysb5FDfVCPv::AlGqIM5fm() |
| Main IL Instruction Count | 134 |
| Main IL | ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_0009: ldloc V_2 br IL_025C: ldsfld C1HXeKA5fRMyog5aija C1HXeKA5fRMyog5aija::MYWA2H9OaV ret <null> nop <null> ldsfld cgH4iZAD1VsBnAcAbgd cgH4iZAD1VsBnAcAbgd::sp1AriHpiR call System.Byte[] cgH4iZAD1VsBnAcAbgd::jrFApGvyxh(cgH4iZAD1VsBnAcAbgd) stloc.s V_3 ldc.i4 3 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) br IL_0057: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 17 beq IL_00C7: ldloc.s V_3 ldloc V_0 ldc.i4 997 beq IL_0057: ldloc V_0 br IL_00E2: leave IL_0031 br IL_01A9: ldloc.s V_3 ldc.i4 6 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret ldc.i4 4 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brtrue IL_0106: ldloc.s V_3 ldc.i4 7 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret ldc.i4 16 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_19f676d5ce0946ca842fa632d29b042a brtrue IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 5 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld pZViUpAFfcRlMWh5rPQ pZViUpAFfcRlMWh5rPQ::j1dA8iIhVX call System.Void pZViUpAFfcRlMWh5rPQ::jrFApGvyxh(System.Byte[],pZViUpAFfcRlMWh5rPQ) ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_a4c1f12bd8da471dad4712454ac32cac brfalse IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 6 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld WZDNyYATVgdKpwpPAM1 WZDNyYATVgdKpwpPAM1::EIOAC6F12n call System.Byte[] WZDNyYATVgdKpwpPAM1::jrFApGvyxh(System.Byte[],WZDNyYATVgdKpwpPAM1) stloc.s V_3 ldc.i4 2 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_5dd44e8ac9ad458da849853ae45220a1 brtrue IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 16 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brfalse IL_00E2: leave IL_0031 ldc.i4 1 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_d348b703232f4318adefadc3db54fbdf brfalse IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) pop <null> ldc.i4 10 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld iTdHwgAVKRa2RDFrxeC iTdHwgAVKRa2RDFrxeC::TXJAbJnWtK call System.Boolean iTdHwgAVKRa2RDFrxeC::jrFApGvyxh(System.Byte[],iTdHwgAVKRa2RDFrxeC) brtrue IL_0131: ldloc.s V_3 ldc.i4 9 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) ldloc.s V_3 ldsfld Fi8NMTAWX22AbgGk7UU Fi8NMTAWX22AbgGk7UU::kqSAn3qZUT call System.Byte[] Fi8NMTAWX22AbgGk7UU::jrFApGvyxh(System.Byte[],Fi8NMTAWX22AbgGk7UU) stloc.s V_3 ldc.i4 17 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_a3495dbcd331453c8bfed09cd79ba4f8 brfalse IL_0053: stloc V_0 pop <null> ldc.i4 3 br IL_0053: stloc V_0 leave IL_0031: ret ldc.i4 8 br IL_005B: switch(IL_01E5,IL_00A9,IL_015E,IL_018E,IL_0131,IL_01A9,IL_00E2,IL_01D6,IL_0106,IL_00B8) leave IL_0031: ret pop <null> ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_7f7230439b20475d823b1bb0a526fb2e brfalse IL_021C: switch(IL_0238) pop <null> ldc.i4 3 br IL_021C: switch(IL_0238) br IL_0218: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0218: ldloc V_1 br IL_0238: leave IL_0031 leave IL_0031: ret ldc.i4 2 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_cf82a7d511364c7a89f7185753764e98 brtrue IL_000D: switch(IL_0032,IL_025C,IL_0031) pop <null> ldc.i4 1 br IL_000D: switch(IL_0032,IL_025C,IL_0031) ldsfld C1HXeKA5fRMyog5aija C1HXeKA5fRMyog5aija::MYWA2H9OaV call System.Void C1HXeKA5fRMyog5aija::jrFApGvyxh(C1HXeKA5fRMyog5aija) ldc.i4 0 ldsfld <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec} <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_ba1bd3c5c3cb41319e9cd0241fa74313 ldfld System.Int32 <Module>{049f4c7c-aad8-49f0-9b38-7e2b33579fec}::m_557de8a55e9442959fc32e7d074593f2 brtrue IL_000D: switch(IL_0032,IL_025C,IL_0031) pop <null> ldc.i4 4 br IL_000D: switch(IL_0032,IL_025C,IL_0031) |