Suspicious
Suspect

d75b3be509fb4f8e936579f2f7ba968f

PE Executable
MD5: d75b3be509fb4f8e936579f2f7ba968f
Size: 762.37 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d75b3be509fb4f8e936579f2f7ba968f
Sha1 88d545c5e7bd59521ec73caee13259fc46c7b14e
Sha256 5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Sha384 1c11bd2f59762bf8a7d7ec2fb3ea6f07f74c64aea84024f01e0c5e8d4ae5f3e7828ed9158bdce1605ae57e18a82167c8
Sha512 06e26bc5e709cc294e5c47ec9ad8a98aa05f0f8b6c147c0081ae9dfe0a73a6f52d013a89baba8940bcee1944ec8de750b49be144bb95de2a7e6f999aaffa11e6
SSDeep 12288:ImsAAxpN0fiD9C52ZqSLNW54KBysCc1TKb0gXLodd01sevie8grGz53LNxzSOL:ILLs0sgZqSLA1BysCc1GJXk8/Mb3LNz
TLSH D2F4127E4D862F15CA3D1EBDC4B318A433F1C403A252E7272EFC40F26AA7B564D62912
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d75b3be509fb4f8e936579f2f7ba968f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Bazregani.tegipica.spss
9asDGp3mg7S.Resources.resources
5d54e8b69e41d4.Resources.resources
ef9af4cc0
[NBF]root.Data
ef9af4cc1
[NBF]root.Data
ef9af4cc2
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
9asDGp3mg7S
Full Name
9asDGp3mg7S
EntryPoint
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Scope Name
9asDGp3mg7S
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
9asDGp3mg7S
Assembly Version
2.13.18.224
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Main IL Instruction Count
213
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003B: nop
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.0 <null>
ldloc.0 <null>
ldnull <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_13
br.s IL_0006: ldloc.s V_13
ldc.i4.3 <null>
br.s IL_004B: stloc.s V_13
nop <null>
ldc.i4 1426475833
ldc.i4 196
ldc.i4.1 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
newobj System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::wr7T4Gxq(System.Reflection.Assembly)
pop <null>
ldloc.1 <null>
nop <null>
ldc.i4 742133351
ldc.i4.3 <null>
ldc.i4.s 27
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::xEc5N6sz(System.String)
pop <null>
ldc.i4.6 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.1 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::eb7Z2oL()
pop <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1<System.Object> te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::Pd0mjKp1t6Q_Z()
stloc.2 <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_4
ldc.i4.s 9
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.s V_4
brfalse.s IL_00BE: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldc.i4.1 <null>
br.s IL_00B7: stloc.s V_13
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.2 <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
nop <null>
br.s IL_00D3: br.s IL_00D5
br.s IL_00D5: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010D: ldloc.2
ldloc.2 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Object> System.Collections.Generic.List`1<System.Object>::GetEnumerator()
stloc.s V_5
ldc.i4.6 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Object System.Collections.Generic.List`1/Enumerator<System.Object>::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0138: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldc.i4.2 <null>
br.s IL_0134: stloc.s V_15
ldc.i4.s 10
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
nop <null>
nop <null>
ldc.i4 1426475238
ldc.i4.6 <null>
ldc.i4.7 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
ldloc.s V_6
callvirt System.Type System.Object::GetType()
callvirt System.String System.Type::get_FullName()
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
ldc.i4.s 10
stloc.s V_15
br IL_00D8: ldloc.s V_15
nop <null>
ldc.i4.6 <null>
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Object>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_018E: ldc.i4.5
ldc.i4.s 9
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldc.i4.5 <null>
br.s IL_0187: stloc.s V_15
leave.s IL_01C4: br.s IL_01C6
br.s IL_0195: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B5: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Object>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_01C6: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01EE: ldloc.2
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0202: ldc.i4.2
ldc.i4.5 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
ldc.i4.2 <null>
br.s IL_01FE: stloc.s V_19
ldloc.2 <null>
call System.Void P_s6nf5TDcy4mL.Ric3zS8::cPe6dx5TH7kgd(System.Collections.Generic.List`1<System.Object>)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
nop <null>
leave.s IL_0266: br.s IL_0268
br.s IL_0217: br.s IL_0219
br.s IL_0219: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0238: br.s IL_023A
br.s IL_023A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
nop <null>
ldc.i4 742133365
ldc.i4.1 <null>
ldc.i4.3 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
ldloc.s V_11
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
br.s IL_025E: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0268: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0288: nop
nop <null>
ret <null>
ldtoken System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
pop <null>
ret <null>
Module Name
9asDGp3mg7S
Full Name
9asDGp3mg7S
EntryPoint
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Scope Name
9asDGp3mg7S
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
9asDGp3mg7S
Assembly Version
2.13.18.224
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Main IL Instruction Count
213
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003B: nop
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.0 <null>
ldloc.0 <null>
ldnull <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_13
br.s IL_0006: ldloc.s V_13
ldc.i4.3 <null>
br.s IL_004B: stloc.s V_13
nop <null>
ldc.i4 1426475833
ldc.i4 196
ldc.i4.1 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
newobj System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::wr7T4Gxq(System.Reflection.Assembly)
pop <null>
ldloc.1 <null>
nop <null>
ldc.i4 742133351
ldc.i4.3 <null>
ldc.i4.s 27
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::xEc5N6sz(System.String)
pop <null>
ldc.i4.6 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.1 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::eb7Z2oL()
pop <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1<System.Object> te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::Pd0mjKp1t6Q_Z()
stloc.2 <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_4
ldc.i4.s 9
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.s V_4
brfalse.s IL_00BE: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldc.i4.1 <null>
br.s IL_00B7: stloc.s V_13
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.2 <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
nop <null>
br.s IL_00D3: br.s IL_00D5
br.s IL_00D5: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010D: ldloc.2
ldloc.2 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Object> System.Collections.Generic.List`1<System.Object>::GetEnumerator()
stloc.s V_5
ldc.i4.6 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Object System.Collections.Generic.List`1/Enumerator<System.Object>::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0138: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldc.i4.2 <null>
br.s IL_0134: stloc.s V_15
ldc.i4.s 10
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
nop <null>
nop <null>
ldc.i4 1426475238
ldc.i4.6 <null>
ldc.i4.7 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
ldloc.s V_6
callvirt System.Type System.Object::GetType()
callvirt System.String System.Type::get_FullName()
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
ldc.i4.s 10
stloc.s V_15
br IL_00D8: ldloc.s V_15
nop <null>
ldc.i4.6 <null>
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Object>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_018E: ldc.i4.5
ldc.i4.s 9
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldc.i4.5 <null>
br.s IL_0187: stloc.s V_15
leave.s IL_01C4: br.s IL_01C6
br.s IL_0195: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B5: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Object>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_01C6: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01EE: ldloc.2
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0202: ldc.i4.2
ldc.i4.5 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
ldc.i4.2 <null>
br.s IL_01FE: stloc.s V_19
ldloc.2 <null>
call System.Void P_s6nf5TDcy4mL.Ric3zS8::cPe6dx5TH7kgd(System.Collections.Generic.List`1<System.Object>)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
nop <null>
leave.s IL_0266: br.s IL_0268
br.s IL_0217: br.s IL_0219
br.s IL_0219: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0238: br.s IL_023A
br.s IL_023A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
nop <null>
ldc.i4 742133365
ldc.i4.1 <null>
ldc.i4.3 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
ldloc.s V_11
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
br.s IL_025E: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0268: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0288: nop
nop <null>
ret <null>
ldtoken System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
pop <null>
ret <null>
d75b3be509fb4f8e936579f2f7ba968f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Bazregani.tegipica.spss
9asDGp3mg7S.Resources.resources
5d54e8b69e41d4.Resources.resources
ef9af4cc0
[NBF]root.Data
ef9af4cc1
[NBF]root.Data
ef9af4cc2
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙