Sign up free
Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file ccf19e127c0b8f65ca072df1bd801924 is a PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 16 embedded or derived files. It matches 6 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
No known threat found
File type
PE Executable

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

17 files
EXEccf19e127c0b8f65ca072df1bd801924
Structure

Name Value
Module Name
5ZqcLzq3fP2oG
Full Name
5ZqcLzq3fP2oG
EntryPoint
System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
Scope Name
5ZqcLzq3fP2oG
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5ZqcLzq3fP2oG
Assembly Version
6.3.25.122
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
Main IL Instruction Count
208
Main IL 
ldsfld System.Char[] 0oyXD.5wbNe6DpoP_::8HctkqK6f0nJC
stloc.s V_14
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.s 11
ldc.i4.s 11
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0051: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.4 <null>
stloc.s V_11
br.s IL_0014: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B9: ldc.i4.4
ldc.i4.s 10
stloc.s V_11
br IL_0014: ldloc.s V_11
ldc.i4.4 <null>
br.s IL_00B2: stloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1335018713
ldc.i4.1 <null>
ldc.i4.2 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object Zpi29.gSw5By::cLt3K(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.s 12
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Rca41xMtP2gj0s.dDm63gGawJf8A::1ywFo4Nr(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_010B: ldc.i4.0
ldc.i4.1 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldc.i4.0 <null>
br.s IL_0104: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 12
ldc.i4.4 <null>
ldtoken Zpi29.gSw5By/Qmo2yg.sDr74cM
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840538
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
nop <null>
nop <null>
ldc.i4.s 12
ldc.i4.7 <null>
ldtoken Zpi29.gSw5By/Cn3t9gyKfFb6n5.8LdzRi4zxW
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840537
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldc.i4.7 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_5
nop <null>
ldnull <null>
ldc.i4 1335018740
ldc.i4.s 9
ldc.i4.0 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
nop <null>
leave IL_0267: br.s IL_0269
br.s IL_018E: br.s IL_0190
br.s IL_0190: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_019B: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01C3: nop
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4.6 <null>
ldtoken 0rfPYe7axi.jZ_4Pk/6niRP9mn3.Go7ta
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840536
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldc.i4.4 <null>
stloc.s V_13
br.s IL_019E: ldloc.s V_13
ldloc.s V_9
nop <null>
ldnull <null>
ldc.i4 1335018713
ldc.i4.8 <null>
ldc.i4.2 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 13
ldc.i4.3 <null>
ldc.i4.5 <null>
ldc.i4 1052948202
call System.String no8W0kKtgs3ZF6.nNq15zaSt2Qr/Dz7wj6rZ8Fdc.ny8Fo5Yakb2::Hbs05GozLc(System.Int32,System.Int32,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldloc.s V_14
ldc.i4 459
ldelem.u2 <null>
ldc.i4 19850
sub <null>
stloc.s V_13
br IL_019E: ldloc.s V_13
nop <null>
leave.s IL_023D: br.s IL_023F
br.s IL_022E: br.s IL_0230
br.s IL_0230: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_023D: br.s IL_023F
br.s IL_023F: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_025F: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0267: br.s IL_0269
br.s IL_0269: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0289: nop
nop <null>
ret <null>
ldtoken System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
pop <null>
ret <null>
Module Name
5ZqcLzq3fP2oG
Full Name
5ZqcLzq3fP2oG
EntryPoint
System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
Scope Name
5ZqcLzq3fP2oG
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5ZqcLzq3fP2oG
Assembly Version
6.3.25.122
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
Main IL Instruction Count
208
Main IL 
ldsfld System.Char[] 0oyXD.5wbNe6DpoP_::8HctkqK6f0nJC
stloc.s V_14
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.s 11
ldc.i4.s 11
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0051: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.4 <null>
stloc.s V_11
br.s IL_0014: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.6 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B9: ldc.i4.4
ldc.i4.s 10
stloc.s V_11
br IL_0014: ldloc.s V_11
ldc.i4.4 <null>
br.s IL_00B2: stloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1335018713
ldc.i4.1 <null>
ldc.i4.2 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object Zpi29.gSw5By::cLt3K(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.s 12
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Rca41xMtP2gj0s.dDm63gGawJf8A::1ywFo4Nr(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_010B: ldc.i4.0
ldc.i4.1 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldc.i4.0 <null>
br.s IL_0104: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 12
ldc.i4.4 <null>
ldtoken Zpi29.gSw5By/Qmo2yg.sDr74cM
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840538
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
nop <null>
nop <null>
ldc.i4.s 12
ldc.i4.7 <null>
ldtoken Zpi29.gSw5By/Cn3t9gyKfFb6n5.8LdzRi4zxW
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840537
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldc.i4.7 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_5
nop <null>
ldnull <null>
ldc.i4 1335018740
ldc.i4.s 9
ldc.i4.0 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_0014: ldloc.s V_11
nop <null>
leave IL_0267: br.s IL_0269
br.s IL_018E: br.s IL_0190
br.s IL_0190: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_019B: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01C3: nop
nop <null>
nop <null>
ldc.i4.5 <null>
ldc.i4.6 <null>
ldtoken 0rfPYe7axi.jZ_4Pk/6niRP9mn3.Go7ta
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 2066840536
call System.String 8Zknq5wEc.Qx1ptEr0::My2izLk5sd8Q9m(System.Int32,System.Int32,System.Type,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldc.i4.4 <null>
stloc.s V_13
br.s IL_019E: ldloc.s V_13
ldloc.s V_9
nop <null>
ldnull <null>
ldc.i4 1335018713
ldc.i4.8 <null>
ldc.i4.2 <null>
call System.String 8Zknq5wEc.Qx1ptEr0::Hw8o0ZdgffR65(System.Reflection.Assembly,System.Int32,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 13
ldc.i4.3 <null>
ldc.i4.5 <null>
ldc.i4 1052948202
call System.String no8W0kKtgs3ZF6.nNq15zaSt2Qr/Dz7wj6rZ8Fdc.ny8Fo5Yakb2::Hbs05GozLc(System.Int32,System.Int32,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldloc.s V_14
ldc.i4 459
ldelem.u2 <null>
ldc.i4 19850
sub <null>
stloc.s V_13
br IL_019E: ldloc.s V_13
nop <null>
leave.s IL_023D: br.s IL_023F
br.s IL_022E: br.s IL_0230
br.s IL_0230: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_023D: br.s IL_023F
br.s IL_023F: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_025F: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0267: br.s IL_0269
br.s IL_0269: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0289: nop
nop <null>
ret <null>
ldtoken System.Void Rca41xMtP2gj0s.dDm63gGawJf8A/oZj4G.oYd5xa1H::7ekKeAf0Bm()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙