Malicious
Malicious

PE Executable
MD5: cfcd031aa3c5215bfde8338912f75875
Size: 642.56 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 cfcd031aa3c5215bfde8338912f75875
Sha1 00f26d8236e7c5c2d0247f70fbf452924ac69fa1
Sha256 4d6ca51fc7742f1d24f33edde514ce413db23688b7ee1064faf0cc689c39a39b
Sha384 7528615569f21412809e5e392f072837a0bc8d612aead6dbd8c110beb404cbe4ba3962f6c998bc40ead206bbc08d6ec3
Sha512 f34f37b5c5e3c83d5885b9a249b6a21134853e55b2fd94b289943a4ed5887083a2c65e760bb78e8ce90b8e2dcb0da218635bf89627097c5a631d4945ef0188ac
SSDeep 12288:lgixe9zO+UE74o54qmxs30eUGrcxSgU6Hvv6vFEJ:2icIosqza4FE
TLSH FDD4AEBB76534E12E3885337C4CB884093BC978675A7F70E358413A75A033AEDE466A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
cfcd031aa3c5215bfde8338912f75875
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
gKA669G8peD3WK6vjg.FoWrK0HfJLerygWyOP
VX8lT2dMDAhcvmfZie.LwlUR01DmF2LoOZwZS
sFZ3nIIfcG7StLNCh7.PZDhmYBWqPRenJsdG7
Aezsg.g.resources
Gcnniboyq.Properties.Resources.resources
Froarnmntr
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Aezsg.exe
Full Name
Aezsg.exe
EntryPoint
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Scope Name
Aezsg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aezsg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Main IL Instruction Count
120
Main IL 
ldc.i4 1
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 989
beq IL_0009: ldloc V_4
br IL_002D: nop
nop <null>
newobj System.Void nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty::.ctor()
stloc.s V_0
ldc.i4 11
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_8a86a1b7bc054478b62b5ee51f3f0a77
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
br IL_0062: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 11
beq IL_018B: newobj System.Void System.InvalidOperationException::.ctor()
ldloc V_1
ldc.i4 991
beq IL_0062: ldloc V_1
br IL_00F9: newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
newobj System.Void bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y::.ctor()
stloc.s V_5
ldc.i4 6
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_100b06ebad8b4e71ab6b605c527fcb92
brfalse IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO::.ctor()
stloc.s V_3
ldc.i4 1
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_02044022bc234133a8cad3bf1737b926
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
dup <null>
dup <null>
ldsfld BWvkvXHDTiF0UNgDvFf BWvkvXHDTiF0UNgDvFf::zWvHK41yYk
call System.Void BWvkvXHDTiF0UNgDvFf::HqxHMoqEwx(System.Object,Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE,BWvkvXHDTiF0UNgDvFf)
dup <null>
ldloc.s V_3
ldsfld gVCvYFHUvW2n1YwOGaw gVCvYFHUvW2n1YwOGaw::yegH953R41
call System.Void gVCvYFHUvW2n1YwOGaw::HqxHMoqEwx(System.Object,Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO,gVCvYFHUvW2n1YwOGaw)
ldloc.s V_3
ldloc.s V_0
ldsfld S06FcwHhyBTY8JG1eOp S06FcwHhyBTY8JG1eOp::IoxH6I5stt
call System.Void S06FcwHhyBTY8JG1eOp::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,S06FcwHhyBTY8JG1eOp)
ldloc.s V_3
ldloc.s V_5
ldsfld iJBxQXHLQ7rjt884BY7 iJBxQXHLQ7rjt884BY7::u9XHWYPHy9
call System.Void iJBxQXHLQ7rjt884BY7::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,iJBxQXHLQ7rjt884BY7)
ldloc.s V_3
ldloc.s V_6
ldsfld FTSXVDHJBbZ1cf0BDCk FTSXVDHJBbZ1cf0BDCk::bhxHx9p6Wi
call System.Void FTSXVDHJBbZ1cf0BDCk::HqxHMoqEwx(System.Object,NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9,FTSXVDHJBbZ1cf0BDCk)
ldloc.s V_6
ldloc.s V_5
ldsfld b5lpXwHYwLCXux2CKTf b5lpXwHYwLCXux2CKTf::UdSHEp7HWK
call System.Void b5lpXwHYwLCXux2CKTf::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,b5lpXwHYwLCXux2CKTf)
ldloc.s V_5
ldloc.s V_0
ldsfld Ubp60BHgW63ybuLicjq Ubp60BHgW63ybuLicjq::CT3HakwSd1
call System.Void Ubp60BHgW63ybuLicjq::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,Ubp60BHgW63ybuLicjq)
ldsfld aPOEJoH8FBsMwu8gydK aPOEJoH8FBsMwu8gydK::TjMH7A4Bq8
call System.Boolean aPOEJoH8FBsMwu8gydK::HqxHMoqEwx(System.Object,aPOEJoH8FBsMwu8gydK)
brtrue IL_0191: leave IL_0208
ldc.i4 0
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_a3f48abe8f704eb6bf9432fbac67bae6
brtrue IL_005E: stloc V_1
pop <null>
ldc.i4 11
br IL_005E: stloc V_1
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0208: ret
pop <null>
ldc.i4 5
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_f82bcc62a7664588b1d76feb665f336b
brtrue IL_01C8: switch(IL_01E4)
pop <null>
ldc.i4 0
br IL_01C8: switch(IL_01E4)
br IL_01C4: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01C4: ldloc V_2
br IL_01E4: leave IL_0208
leave IL_0208: ret
ldc.i4 3
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_b8b824387f34486a8ece8da17dc97dc7
brfalse IL_000D: switch(IL_0208,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0208,IL_002D)
ret <null>
Module Name
Aezsg.exe
Full Name
Aezsg.exe
EntryPoint
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Scope Name
Aezsg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aezsg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Main IL Instruction Count
120
Main IL 
ldc.i4 1
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 989
beq IL_0009: ldloc V_4
br IL_002D: nop
nop <null>
newobj System.Void nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty::.ctor()
stloc.s V_0
ldc.i4 11
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_8a86a1b7bc054478b62b5ee51f3f0a77
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
br IL_0062: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 11
beq IL_018B: newobj System.Void System.InvalidOperationException::.ctor()
ldloc V_1
ldc.i4 991
beq IL_0062: ldloc V_1
br IL_00F9: newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
newobj System.Void bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y::.ctor()
stloc.s V_5
ldc.i4 6
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_100b06ebad8b4e71ab6b605c527fcb92
brfalse IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO::.ctor()
stloc.s V_3
ldc.i4 1
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_02044022bc234133a8cad3bf1737b926
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
dup <null>
dup <null>
ldsfld BWvkvXHDTiF0UNgDvFf BWvkvXHDTiF0UNgDvFf::zWvHK41yYk
call System.Void BWvkvXHDTiF0UNgDvFf::HqxHMoqEwx(System.Object,Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE,BWvkvXHDTiF0UNgDvFf)
dup <null>
ldloc.s V_3
ldsfld gVCvYFHUvW2n1YwOGaw gVCvYFHUvW2n1YwOGaw::yegH953R41
call System.Void gVCvYFHUvW2n1YwOGaw::HqxHMoqEwx(System.Object,Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO,gVCvYFHUvW2n1YwOGaw)
ldloc.s V_3
ldloc.s V_0
ldsfld S06FcwHhyBTY8JG1eOp S06FcwHhyBTY8JG1eOp::IoxH6I5stt
call System.Void S06FcwHhyBTY8JG1eOp::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,S06FcwHhyBTY8JG1eOp)
ldloc.s V_3
ldloc.s V_5
ldsfld iJBxQXHLQ7rjt884BY7 iJBxQXHLQ7rjt884BY7::u9XHWYPHy9
call System.Void iJBxQXHLQ7rjt884BY7::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,iJBxQXHLQ7rjt884BY7)
ldloc.s V_3
ldloc.s V_6
ldsfld FTSXVDHJBbZ1cf0BDCk FTSXVDHJBbZ1cf0BDCk::bhxHx9p6Wi
call System.Void FTSXVDHJBbZ1cf0BDCk::HqxHMoqEwx(System.Object,NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9,FTSXVDHJBbZ1cf0BDCk)
ldloc.s V_6
ldloc.s V_5
ldsfld b5lpXwHYwLCXux2CKTf b5lpXwHYwLCXux2CKTf::UdSHEp7HWK
call System.Void b5lpXwHYwLCXux2CKTf::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,b5lpXwHYwLCXux2CKTf)
ldloc.s V_5
ldloc.s V_0
ldsfld Ubp60BHgW63ybuLicjq Ubp60BHgW63ybuLicjq::CT3HakwSd1
call System.Void Ubp60BHgW63ybuLicjq::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,Ubp60BHgW63ybuLicjq)
ldsfld aPOEJoH8FBsMwu8gydK aPOEJoH8FBsMwu8gydK::TjMH7A4Bq8
call System.Boolean aPOEJoH8FBsMwu8gydK::HqxHMoqEwx(System.Object,aPOEJoH8FBsMwu8gydK)
brtrue IL_0191: leave IL_0208
ldc.i4 0
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_a3f48abe8f704eb6bf9432fbac67bae6
brtrue IL_005E: stloc V_1
pop <null>
ldc.i4 11
br IL_005E: stloc V_1
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0208: ret
pop <null>
ldc.i4 5
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_f82bcc62a7664588b1d76feb665f336b
brtrue IL_01C8: switch(IL_01E4)
pop <null>
ldc.i4 0
br IL_01C8: switch(IL_01E4)
br IL_01C4: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01C4: ldloc V_2
br IL_01E4: leave IL_0208
leave IL_0208: ret
ldc.i4 3
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_b8b824387f34486a8ece8da17dc97dc7
brfalse IL_000D: switch(IL_0208,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0208,IL_002D)
ret <null>
cfcd031aa3c5215bfde8338912f75875
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
gKA669G8peD3WK6vjg.FoWrK0HfJLerygWyOP
VX8lT2dMDAhcvmfZie.LwlUR01DmF2LoOZwZS
sFZ3nIIfcG7StLNCh7.PZDhmYBWqPRenJsdG7
Aezsg.g.resources
Gcnniboyq.Properties.Resources.resources
Froarnmntr
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙