Suspicious
Suspect

c5dcdd03653ab421d994c1049ff55124

PE Executable
MD5: c5dcdd03653ab421d994c1049ff55124
Size: 973.82 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c5dcdd03653ab421d994c1049ff55124
Sha1 9783903053eb5a1f028afd05adad08c9a20f29c1
Sha256 e12f9f6dd4d092492c0d9e422da3123d88ed33ebdbb77706454e0a4a534aff5e
Sha384 f68c691d44a961f3004446b93834116ddc8934e48d372be8a91d5d596d5e525a8fa0dda9215ff052e7a89b0d015237be
Sha512 1551ed7ab3d7036794690a6af4b7c05996219ce73335b252b958544593a25febdac8c3f6cfeba3185279d9f7ef160af0cd5ce6653b8d608dd3a15d3a08b4b620
SSDeep 24576:Iz9qnshUTLIH07BDyqFiSt1OMzEAOEY2Eg6cBgeaBpN:IGshTU9DyqwG1rz/OEh6IaBpN
TLSH 77252374E06D84F5E866BF3ED947A0C481EC71C38913B01BB96B540E4B42FD69A5E2F2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c5dcdd03653ab421d994c1049ff55124
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Iobul.Properties.Resources.resources
Gjtleur
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Fxvmbzcu.exe
Full Name
Fxvmbzcu.exe
EntryPoint
System.Void Iobul.Services.SolverReceiver::WaitAccessibleService()
Scope Name
Fxvmbzcu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fxvmbzcu
Assembly Version
1.0.6588.14532
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
6
Main Method
System.Void Iobul.Services.SolverReceiver::WaitAccessibleService()
Main IL Instruction Count
32
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0059: ldsfld Iobul.Services.SolverReceiver/<>c Iobul.Services.SolverReceiver/<>c::_PortableDispatcher
ret <null>
ldsfld System.Action`1<System.IO.MemoryStream> Iobul.Services.SolverReceiver/<>c::m_StubTag
dup <null>
brfalse IL_0039: pop
br IL_006F: call System.Void Iobul.Services.SolverReceiver::WaitExternalService(System.Action`1<System.IO.MemoryStream>)
pop <null>
ldc.i4 0
ldsfld <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3} <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_a5c2add5701c458fb7cc842b7d7a70d5
ldfld System.Int32 <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_8521bcafbdc747ff95f586b1788ffaa6
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ldsfld Iobul.Services.SolverReceiver/<>c Iobul.Services.SolverReceiver/<>c::_PortableDispatcher
ldftn System.Void Iobul.Services.SolverReceiver/<>c::IdleControllableService(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.IO.MemoryStream> Iobul.Services.SolverReceiver/<>c::m_StubTag
call System.Void Iobul.Services.SolverReceiver::WaitExternalService(System.Action`1<System.IO.MemoryStream>)
ldc.i4 2
ldsfld <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3} <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_a5c2add5701c458fb7cc842b7d7a70d5
ldfld System.Int32 <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_8d5df3fedc6e48a78cc53ccc5577b1a5
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name
Fxvmbzcu.exe
Full Name
Fxvmbzcu.exe
EntryPoint
System.Void Iobul.Services.SolverReceiver::WaitAccessibleService()
Scope Name
Fxvmbzcu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fxvmbzcu
Assembly Version
1.0.6588.14532
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
6
Main Method
System.Void Iobul.Services.SolverReceiver::WaitAccessibleService()
Main IL Instruction Count
32
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0059: ldsfld Iobul.Services.SolverReceiver/<>c Iobul.Services.SolverReceiver/<>c::_PortableDispatcher
ret <null>
ldsfld System.Action`1<System.IO.MemoryStream> Iobul.Services.SolverReceiver/<>c::m_StubTag
dup <null>
brfalse IL_0039: pop
br IL_006F: call System.Void Iobul.Services.SolverReceiver::WaitExternalService(System.Action`1<System.IO.MemoryStream>)
pop <null>
ldc.i4 0
ldsfld <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3} <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_a5c2add5701c458fb7cc842b7d7a70d5
ldfld System.Int32 <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_8521bcafbdc747ff95f586b1788ffaa6
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ldsfld Iobul.Services.SolverReceiver/<>c Iobul.Services.SolverReceiver/<>c::_PortableDispatcher
ldftn System.Void Iobul.Services.SolverReceiver/<>c::IdleControllableService(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.IO.MemoryStream> Iobul.Services.SolverReceiver/<>c::m_StubTag
call System.Void Iobul.Services.SolverReceiver::WaitExternalService(System.Action`1<System.IO.MemoryStream>)
ldc.i4 2
ldsfld <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3} <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_a5c2add5701c458fb7cc842b7d7a70d5
ldfld System.Int32 <Module>{3b6618be-05e4-4876-936a-a5019ffb94b3}::m_8d5df3fedc6e48a78cc53ccc5577b1a5
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
c5dcdd03653ab421d994c1049ff55124
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Iobul.Properties.Resources.resources
Gjtleur
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙