Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEcfeb81060c03bfd09b5adf5352e84af7XWorm
Structure
Name Value
Module Name
XClient.exe
Full Name
XClient.exe
EntryPoint
System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Scope Name
XClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
237
Main Method
System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Main IL Instruction Count
83
Main IL 
ldsfld System.Int32 ibcUoDcZvw4P::IBmovkQGaqxi
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq
ldsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg
ldsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n
ldsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk
ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
brtrue.s IL_0097: ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
call System.String Stub.JUjqBGI4b6RQ::NXijwMSlAkim(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String ibcUoDcZvw4P::tj1GFfxJQ7eO
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String ibcUoDcZvw4P::bLeSfbeUudlv
call System.Void Stub.uzrBa4G9ur6v::A1jLWigUL74d()
ldnull <null>
ldftn System.Void Stub.JUjqBGI4b6RQ::CU2CXpCrc9aU()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.JUjqBGI4b6RQ::CVvCElbbWYwz()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
XClient.exe
Full Name
XClient.exe
EntryPoint
System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Scope Name
XClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
237
Main Method
System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Main IL Instruction Count
83
Main IL 
ldsfld System.Int32 ibcUoDcZvw4P::IBmovkQGaqxi
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq
ldsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg
ldsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n
ldsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk
ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH()
brtrue.s IL_0097: ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ
call System.String Stub.JUjqBGI4b6RQ::NXijwMSlAkim(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String ibcUoDcZvw4P::tj1GFfxJQ7eO
ldloc.0 <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_4
callvirt System.String[] System.String::Split(System.Char[])
ldc.i4.1 <null>
ldelem.ref <null>
stsfld System.String ibcUoDcZvw4P::bLeSfbeUudlv
call System.Void Stub.uzrBa4G9ur6v::A1jLWigUL74d()
ldnull <null>
ldftn System.Void Stub.JUjqBGI4b6RQ::CU2CXpCrc9aU()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.JUjqBGI4b6RQ::CVvCElbbWYwz()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙