Malicious PE Executable analysis – d609d5571d97

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXEd609d5571d9715d29634ffe6e96ce350

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Qsdhns.exe
Full Name	Qsdhns.exe
EntryPoint	System.Void GVyPCq3spiJYCemp8b.otUDHkCesgC7NtMtf2::ThnfwKg9m()
Scope Name	Qsdhns.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Qsdhns
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void GVyPCq3spiJYCemp8b.otUDHkCesgC7NtMtf2::ThnfwKg9m()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void dYAPiRVYV36NscH0Uv.XhFEgbY73GwEV60igr::.ctor() ldsfld m91EUMKfNfYmtOoTM5g m91EUMKfNfYmtOoTM5g::PDIKR6K8yu call System.Boolean m91EUMKfNfYmtOoTM5g::UgEKK4euSO(System.Object,m91EUMKfNfYmtOoTM5g) brtrue IL_0096: leave IL_002D ldc.i4 3 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_becb3eb1f2b84ce88c5a3ecf4c5c9a77 brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0070: ldloc V_0 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_d259e3d054e34006ae0934f8c9cc9d85 brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 5 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_10c31906779247f0b02c2e44ee0450d2 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Qsdhns.exe
Full Name	Qsdhns.exe
EntryPoint	System.Void GVyPCq3spiJYCemp8b.otUDHkCesgC7NtMtf2::ThnfwKg9m()
Scope Name	Qsdhns.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Qsdhns
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void GVyPCq3spiJYCemp8b.otUDHkCesgC7NtMtf2::ThnfwKg9m()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void dYAPiRVYV36NscH0Uv.XhFEgbY73GwEV60igr::.ctor() ldsfld m91EUMKfNfYmtOoTM5g m91EUMKfNfYmtOoTM5g::PDIKR6K8yu call System.Boolean m91EUMKfNfYmtOoTM5g::UgEKK4euSO(System.Object,m91EUMKfNfYmtOoTM5g) brtrue IL_0096: leave IL_002D ldc.i4 3 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_becb3eb1f2b84ce88c5a3ecf4c5c9a77 brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0070: ldloc V_0 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_d259e3d054e34006ae0934f8c9cc9d85 brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 5 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{65ac0114-bcba-483b-8d66-a7027def1ace} <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_c45f007299234175bdee99f24aaf7812 ldfld System.Int32 <Module>{65ac0114-bcba-483b-8d66-a7027def1ace}::m_10c31906779247f0b02c2e44ee0450d2 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)