Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 6 files
EXEd31f4e6be65b4246165876818badf574
Structure
P7B[Authenticode]_54209be0.p7b
Name Value
Info
Authenticode present at 0x15C200 size 11896 bytes
Module Name
Zkkjgnk.exe
Full Name
Zkkjgnk.exe
EntryPoint
System.Void BitMiracle.Profiling.SimpleProfile::AnalyzePassiveProfile()
Scope Name
Zkkjgnk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zkkjgnk
Assembly Version
5.5.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1209
Main Method
System.Void BitMiracle.Profiling.SimpleProfile::AnalyzePassiveProfile()
Main IL Instruction Count
107
Main IL 
ldc.i4 2
stloc V_1
br IL_000E: ldloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B3: ret
nop <null>
ldloc.s V_0
callvirt System.String Zkkjgnk.EventManagement.EventClient::TriggerMixedEvent()
brfalse IL_012C: leave IL_01B3
ldc.i4 4
stloc V_4
br IL_0043: ldloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_0091: br IL_012C
ldloc.s V_2
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
bgt IL_00A4: ldloc.s V_2
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_dccda816824b4c1a8d8ec5b3e44abc16
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 0
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
br IL_012C: leave IL_01B3
ldc.i4 3
stloc V_4
br IL_0043: ldloc V_4
ldloc.s V_2
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr CbP9rXiuj
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_16b25e7fda0e413693c71fb3126ef7c0
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 1
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
ldloc.s V_0
callvirt System.Type[] Zkkjgnk.EventManagement.EventClient::ExcludeEvent()
ldsfld System.Func`2<System.Type,System.Boolean> BitMiracle.Profiling.SimpleProfile/<>c::m_GatewayCompiler
dup <null>
brtrue IL_0106: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld BitMiracle.Profiling.SimpleProfile/<>c BitMiracle.Profiling.SimpleProfile/<>c::m_AnnotationContainer
ldftn System.Boolean BitMiracle.Profiling.SimpleProfile/<>c::RedirectAdvancedTemplate(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> BitMiracle.Profiling.SimpleProfile/<>c::m_GatewayCompiler
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_2
ldc.i4 2
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_d5f96906529f443b9b159181ad6ae149
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 1
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
leave IL_01B3: ret
ldloc.s V_0
brfalse IL_0193: endfinally
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_62c69da17eb649ff9b3f1bf2b5034070
brfalse IL_015B: switch(IL_0193,IL_016D)
pop <null>
ldc.i4 1
br IL_015B: switch(IL_0193,IL_016D)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0193: endfinally
ldloc.s V_0
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_6c2afeb91e5d490e9ccd32660d32c005
brtrue IL_015B: switch(IL_0193,IL_016D)
pop <null>
ldc.i4 0
br IL_015B: switch(IL_0193,IL_016D)
endfinally <null>
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_ed3603002ff7447eb4fec07891cb2fca
brtrue IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
ret <null>
newobj System.Void Zkkjgnk.EventManagement.EventClient::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_588fac69412d423fbced4c71d3092da9
brtrue IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
Module Name
Zkkjgnk.exe
Full Name
Zkkjgnk.exe
EntryPoint
System.Void BitMiracle.Profiling.SimpleProfile::AnalyzePassiveProfile()
Scope Name
Zkkjgnk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zkkjgnk
Assembly Version
5.5.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1209
Main Method
System.Void BitMiracle.Profiling.SimpleProfile::AnalyzePassiveProfile()
Main IL Instruction Count
107
Main IL 
ldc.i4 2
stloc V_1
br IL_000E: ldloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B3: ret
nop <null>
ldloc.s V_0
callvirt System.String Zkkjgnk.EventManagement.EventClient::TriggerMixedEvent()
brfalse IL_012C: leave IL_01B3
ldc.i4 4
stloc V_4
br IL_0043: ldloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_0091: br IL_012C
ldloc.s V_2
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
bgt IL_00A4: ldloc.s V_2
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_dccda816824b4c1a8d8ec5b3e44abc16
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 0
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
br IL_012C: leave IL_01B3
ldc.i4 3
stloc V_4
br IL_0043: ldloc V_4
ldloc.s V_2
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr CbP9rXiuj
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_16b25e7fda0e413693c71fb3126ef7c0
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 1
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
ldloc.s V_0
callvirt System.Type[] Zkkjgnk.EventManagement.EventClient::ExcludeEvent()
ldsfld System.Func`2<System.Type,System.Boolean> BitMiracle.Profiling.SimpleProfile/<>c::m_GatewayCompiler
dup <null>
brtrue IL_0106: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld BitMiracle.Profiling.SimpleProfile/<>c BitMiracle.Profiling.SimpleProfile/<>c::m_AnnotationContainer
ldftn System.Boolean BitMiracle.Profiling.SimpleProfile/<>c::RedirectAdvancedTemplate(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> BitMiracle.Profiling.SimpleProfile/<>c::m_GatewayCompiler
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_2
ldc.i4 2
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_d5f96906529f443b9b159181ad6ae149
brtrue IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
pop <null>
ldc.i4 1
br IL_0047: switch(IL_0091,IL_012C,IL_0065,IL_00A4,IL_00DD)
leave IL_01B3: ret
ldloc.s V_0
brfalse IL_0193: endfinally
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_62c69da17eb649ff9b3f1bf2b5034070
brfalse IL_015B: switch(IL_0193,IL_016D)
pop <null>
ldc.i4 1
br IL_015B: switch(IL_0193,IL_016D)
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_0193: endfinally
ldloc.s V_0
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_6c2afeb91e5d490e9ccd32660d32c005
brtrue IL_015B: switch(IL_0193,IL_016D)
pop <null>
ldc.i4 0
br IL_015B: switch(IL_0193,IL_016D)
endfinally <null>
ldc.i4 0
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_ed3603002ff7447eb4fec07891cb2fca
brtrue IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
ret <null>
newobj System.Void Zkkjgnk.EventManagement.EventClient::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d} <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_3043dd4615e24292af735884ac00e6e0
ldfld System.Int32 <Module>{bbdf45f2-6ec7-43ee-b0f7-32c36cad566d}::m_588fac69412d423fbced4c71d3092da9
brtrue IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01B3,IL_0028,IL_01B4)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙