Malicious PE Executable analysis – c34be59dd654

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Low

1 malicious · 5 files

EXEc34be59dd65449f1f59567c0649d6903

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Jlwoq.exe
Full Name	Jlwoq.exe
EntryPoint	System.Void SteamKit2.Matching.MatcherExecutor::MatchSortedMatcher()
Scope Name	Jlwoq.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Jlwoq
Assembly Version	1.0.4628.12714
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void SteamKit2.Matching.MatcherExecutor::MatchSortedMatcher()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void SteamKit2.Testing.MatcherTester::.ctor() call System.Byte[] SteamKit2.Testing.MatcherTester::InspectEditableTester() call System.Byte[] SteamKit2.Concurrency.WorkerRequester::RunDetailedWorker(System.Object) call System.Void SteamKit2.Collections.SolverDic::RetrieveFlexibleDic(System.Object) ldc.i4 0 ldsfld <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee} <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee}::m_f9533508d37249a1856916e014ee130b ldfld System.Int32 <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee}::m_6f300155b5724d22a7694aeed8aee7ab brtrue IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)
Module Name	Jlwoq.exe
Full Name	Jlwoq.exe
EntryPoint	System.Void SteamKit2.Matching.MatcherExecutor::MatchSortedMatcher()
Scope Name	Jlwoq.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Jlwoq
Assembly Version	1.0.4628.12714
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void SteamKit2.Matching.MatcherExecutor::MatchSortedMatcher()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void SteamKit2.Testing.MatcherTester::.ctor() call System.Byte[] SteamKit2.Testing.MatcherTester::InspectEditableTester() call System.Byte[] SteamKit2.Concurrency.WorkerRequester::RunDetailedWorker(System.Object) call System.Void SteamKit2.Collections.SolverDic::RetrieveFlexibleDic(System.Object) ldc.i4 0 ldsfld <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee} <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee}::m_f9533508d37249a1856916e014ee130b ldfld System.Int32 <Module>{6d9d8a6d-70ec-4c85-ac66-327556108fee}::m_6f300155b5724d22a7694aeed8aee7ab brtrue IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)