Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: cfcd031aa3c5215bfde8338912f75875
Size: 642.56 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 cfcd031aa3c5215bfde8338912f75875
Sha1 00f26d8236e7c5c2d0247f70fbf452924ac69fa1
Sha256 4d6ca51fc7742f1d24f33edde514ce413db23688b7ee1064faf0cc689c39a39b
Sha384 7528615569f21412809e5e392f072837a0bc8d612aead6dbd8c110beb404cbe4ba3962f6c998bc40ead206bbc08d6ec3
Sha512 f34f37b5c5e3c83d5885b9a249b6a21134853e55b2fd94b289943a4ed5887083a2c65e760bb78e8ce90b8e2dcb0da218635bf89627097c5a631d4945ef0188ac
SSDeep 12288:lgixe9zO+UE74o54qmxs30eUGrcxSgU6Hvv6vFEJ:2icIosqza4FE
TLSH FDD4AEBB76534E12E3885337C4CB884093BC978675A7F70E358413A75A033AEDE466A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
cfcd031aa3c5215bfde8338912f75875
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
gKA669G8peD3WK6vjg.FoWrK0HfJLerygWyOP
VX8lT2dMDAhcvmfZie.LwlUR01DmF2LoOZwZS
sFZ3nIIfcG7StLNCh7.PZDhmYBWqPRenJsdG7
Aezsg.g.resources
Gcnniboyq.Properties.Resources.resources
Froarnmntr
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Aezsg.exe
Full Name
Aezsg.exe
EntryPoint
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Scope Name
Aezsg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aezsg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Main IL Instruction Count
120
Main IL 
ldc.i4 1
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 989
beq IL_0009: ldloc V_4
br IL_002D: nop
nop <null>
newobj System.Void nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty::.ctor()
stloc.s V_0
ldc.i4 11
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_8a86a1b7bc054478b62b5ee51f3f0a77
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
br IL_0062: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 11
beq IL_018B: newobj System.Void System.InvalidOperationException::.ctor()
ldloc V_1
ldc.i4 991
beq IL_0062: ldloc V_1
br IL_00F9: newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
newobj System.Void bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y::.ctor()
stloc.s V_5
ldc.i4 6
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_100b06ebad8b4e71ab6b605c527fcb92
brfalse IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO::.ctor()
stloc.s V_3
ldc.i4 1
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_02044022bc234133a8cad3bf1737b926
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
dup <null>
dup <null>
ldsfld BWvkvXHDTiF0UNgDvFf BWvkvXHDTiF0UNgDvFf::zWvHK41yYk
call System.Void BWvkvXHDTiF0UNgDvFf::HqxHMoqEwx(System.Object,Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE,BWvkvXHDTiF0UNgDvFf)
dup <null>
ldloc.s V_3
ldsfld gVCvYFHUvW2n1YwOGaw gVCvYFHUvW2n1YwOGaw::yegH953R41
call System.Void gVCvYFHUvW2n1YwOGaw::HqxHMoqEwx(System.Object,Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO,gVCvYFHUvW2n1YwOGaw)
ldloc.s V_3
ldloc.s V_0
ldsfld S06FcwHhyBTY8JG1eOp S06FcwHhyBTY8JG1eOp::IoxH6I5stt
call System.Void S06FcwHhyBTY8JG1eOp::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,S06FcwHhyBTY8JG1eOp)
ldloc.s V_3
ldloc.s V_5
ldsfld iJBxQXHLQ7rjt884BY7 iJBxQXHLQ7rjt884BY7::u9XHWYPHy9
call System.Void iJBxQXHLQ7rjt884BY7::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,iJBxQXHLQ7rjt884BY7)
ldloc.s V_3
ldloc.s V_6
ldsfld FTSXVDHJBbZ1cf0BDCk FTSXVDHJBbZ1cf0BDCk::bhxHx9p6Wi
call System.Void FTSXVDHJBbZ1cf0BDCk::HqxHMoqEwx(System.Object,NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9,FTSXVDHJBbZ1cf0BDCk)
ldloc.s V_6
ldloc.s V_5
ldsfld b5lpXwHYwLCXux2CKTf b5lpXwHYwLCXux2CKTf::UdSHEp7HWK
call System.Void b5lpXwHYwLCXux2CKTf::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,b5lpXwHYwLCXux2CKTf)
ldloc.s V_5
ldloc.s V_0
ldsfld Ubp60BHgW63ybuLicjq Ubp60BHgW63ybuLicjq::CT3HakwSd1
call System.Void Ubp60BHgW63ybuLicjq::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,Ubp60BHgW63ybuLicjq)
ldsfld aPOEJoH8FBsMwu8gydK aPOEJoH8FBsMwu8gydK::TjMH7A4Bq8
call System.Boolean aPOEJoH8FBsMwu8gydK::HqxHMoqEwx(System.Object,aPOEJoH8FBsMwu8gydK)
brtrue IL_0191: leave IL_0208
ldc.i4 0
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_a3f48abe8f704eb6bf9432fbac67bae6
brtrue IL_005E: stloc V_1
pop <null>
ldc.i4 11
br IL_005E: stloc V_1
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0208: ret
pop <null>
ldc.i4 5
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_f82bcc62a7664588b1d76feb665f336b
brtrue IL_01C8: switch(IL_01E4)
pop <null>
ldc.i4 0
br IL_01C8: switch(IL_01E4)
br IL_01C4: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01C4: ldloc V_2
br IL_01E4: leave IL_0208
leave IL_0208: ret
ldc.i4 3
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_b8b824387f34486a8ece8da17dc97dc7
brfalse IL_000D: switch(IL_0208,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0208,IL_002D)
ret <null>
Module Name
Aezsg.exe
Full Name
Aezsg.exe
EntryPoint
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Scope Name
Aezsg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aezsg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void GEt9d4eukUxLySIQYO.FxaGulSrDcnC6gegWn::vRujimN8G()
Main IL Instruction Count
120
Main IL 
ldc.i4 1
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 989
beq IL_0009: ldloc V_4
br IL_002D: nop
nop <null>
newobj System.Void nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty::.ctor()
stloc.s V_0
ldc.i4 11
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_8a86a1b7bc054478b62b5ee51f3f0a77
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
br IL_0062: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 11
beq IL_018B: newobj System.Void System.InvalidOperationException::.ctor()
ldloc V_1
ldc.i4 991
beq IL_0062: ldloc V_1
br IL_00F9: newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
newobj System.Void bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y::.ctor()
stloc.s V_5
ldc.i4 6
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_100b06ebad8b4e71ab6b605c527fcb92
brfalse IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO::.ctor()
stloc.s V_3
ldc.i4 1
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_02044022bc234133a8cad3bf1737b926
brtrue IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
pop <null>
ldc.i4 2
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0066: switch(IL_009C,IL_00F9,IL_00E8,IL_00C2)
newobj System.Void Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE::.ctor()
dup <null>
dup <null>
ldsfld BWvkvXHDTiF0UNgDvFf BWvkvXHDTiF0UNgDvFf::zWvHK41yYk
call System.Void BWvkvXHDTiF0UNgDvFf::HqxHMoqEwx(System.Object,Ffdd500SPfO2sGjEAV.Krq3Z0fBq6MKElrNvE,BWvkvXHDTiF0UNgDvFf)
dup <null>
ldloc.s V_3
ldsfld gVCvYFHUvW2n1YwOGaw gVCvYFHUvW2n1YwOGaw::yegH953R41
call System.Void gVCvYFHUvW2n1YwOGaw::HqxHMoqEwx(System.Object,Cbr55XgGBcNcCv1uWx.wf9PhuEaAljROxvPEO,gVCvYFHUvW2n1YwOGaw)
ldloc.s V_3
ldloc.s V_0
ldsfld S06FcwHhyBTY8JG1eOp S06FcwHhyBTY8JG1eOp::IoxH6I5stt
call System.Void S06FcwHhyBTY8JG1eOp::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,S06FcwHhyBTY8JG1eOp)
ldloc.s V_3
ldloc.s V_5
ldsfld iJBxQXHLQ7rjt884BY7 iJBxQXHLQ7rjt884BY7::u9XHWYPHy9
call System.Void iJBxQXHLQ7rjt884BY7::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,iJBxQXHLQ7rjt884BY7)
ldloc.s V_3
ldloc.s V_6
ldsfld FTSXVDHJBbZ1cf0BDCk FTSXVDHJBbZ1cf0BDCk::bhxHx9p6Wi
call System.Void FTSXVDHJBbZ1cf0BDCk::HqxHMoqEwx(System.Object,NTGVXNymmioyPv4eVI.RVg0AM5F53NhIE3tm9,FTSXVDHJBbZ1cf0BDCk)
ldloc.s V_6
ldloc.s V_5
ldsfld b5lpXwHYwLCXux2CKTf b5lpXwHYwLCXux2CKTf::UdSHEp7HWK
call System.Void b5lpXwHYwLCXux2CKTf::HqxHMoqEwx(System.Object,bx3CBURte636bOvQOF.kt8pgNceTJshtv0J3y,b5lpXwHYwLCXux2CKTf)
ldloc.s V_5
ldloc.s V_0
ldsfld Ubp60BHgW63ybuLicjq Ubp60BHgW63ybuLicjq::CT3HakwSd1
call System.Void Ubp60BHgW63ybuLicjq::HqxHMoqEwx(System.Object,nJZwEm96wMdyeaIM66.CYrWnpU3sw5itys3Ty,Ubp60BHgW63ybuLicjq)
ldsfld aPOEJoH8FBsMwu8gydK aPOEJoH8FBsMwu8gydK::TjMH7A4Bq8
call System.Boolean aPOEJoH8FBsMwu8gydK::HqxHMoqEwx(System.Object,aPOEJoH8FBsMwu8gydK)
brtrue IL_0191: leave IL_0208
ldc.i4 0
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_a3f48abe8f704eb6bf9432fbac67bae6
brtrue IL_005E: stloc V_1
pop <null>
ldc.i4 11
br IL_005E: stloc V_1
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_0208: ret
pop <null>
ldc.i4 5
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_f82bcc62a7664588b1d76feb665f336b
brtrue IL_01C8: switch(IL_01E4)
pop <null>
ldc.i4 0
br IL_01C8: switch(IL_01E4)
br IL_01C4: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01C4: ldloc V_2
br IL_01E4: leave IL_0208
leave IL_0208: ret
ldc.i4 3
ldsfld <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db} <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_e2a199a9e8fa4dc691c9b7c6f3bf9348
ldfld System.Int32 <Module>{074a4144-303b-4321-bfc3-b27a9c1c56db}::m_b8b824387f34486a8ece8da17dc97dc7
brfalse IL_000D: switch(IL_0208,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0208,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙