Malicious PE Executable analysis – d5a763499c47

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Low

1 malicious · 13 files

EXEd5a763499c470e90265c9b6d7640c831

Structure

P7B[Authenticode]_c3e86401.p7b

BINResources

BIN.Net Resources

Name	Value
Info	Authenticode present at 0x36F800 size 11896 bytes
Module Name	Wseva.exe
Full Name	Wseva.exe
EntryPoint	System.Void Wseva.Compilers.CompilerQueue::InsertCompiler()
Scope Name	Wseva.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wseva
Assembly Version	5.5.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Wseva.Compilers.CompilerQueue::InsertCompiler()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void SteamKit2.Networking.TesterListener::.ctor() call System.Byte[] SteamKit2.Networking.TesterListener::ReceiveFilteredRequest() call System.Byte[] Wseva.Collections.AlphabeticEnumerator::GetNextExpandableEnumerator(System.Object) call System.Void SteamKit2.Execution.DividedRunner::RunExternalRunner(System.Object) ldc.i4 0 ldsfld <Module>{49f36982-0cce-4641-86b2-57a384219256} <Module>{49f36982-0cce-4641-86b2-57a384219256}::m_3a7c800e631e4d78812e2a664fe47e9d ldfld System.Int32 <Module>{49f36982-0cce-4641-86b2-57a384219256}::m_297b9fa0b0d54776ad98963bbe9c3128 brfalse IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)
Module Name	Wseva.exe
Full Name	Wseva.exe
EntryPoint	System.Void Wseva.Compilers.CompilerQueue::InsertCompiler()
Scope Name	Wseva.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wseva
Assembly Version	5.5.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Wseva.Compilers.CompilerQueue::InsertCompiler()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void SteamKit2.Networking.TesterListener::.ctor() call System.Byte[] SteamKit2.Networking.TesterListener::ReceiveFilteredRequest() call System.Byte[] Wseva.Collections.AlphabeticEnumerator::GetNextExpandableEnumerator(System.Object) call System.Void SteamKit2.Execution.DividedRunner::RunExternalRunner(System.Object) ldc.i4 0 ldsfld <Module>{49f36982-0cce-4641-86b2-57a384219256} <Module>{49f36982-0cce-4641-86b2-57a384219256}::m_3a7c800e631e4d78812e2a664fe47e9d ldfld System.Int32 <Module>{49f36982-0cce-4641-86b2-57a384219256}::m_297b9fa0b0d54776ad98963bbe9c3128 brfalse IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)