Suspicious
Suspect

d75b3be509fb4f8e936579f2f7ba968f

Share on LinkedIn
Print
PE Executable
MD5: d75b3be509fb4f8e936579f2f7ba968f
Size: 762.37 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d75b3be509fb4f8e936579f2f7ba968f
Sha1 88d545c5e7bd59521ec73caee13259fc46c7b14e
Sha256 5569b3672ad17216d5437da5fd9c2cdc27c25c25169d61eb1a890e995ea2df0f
Sha384 1c11bd2f59762bf8a7d7ec2fb3ea6f07f74c64aea84024f01e0c5e8d4ae5f3e7828ed9158bdce1605ae57e18a82167c8
Sha512 06e26bc5e709cc294e5c47ec9ad8a98aa05f0f8b6c147c0081ae9dfe0a73a6f52d013a89baba8940bcee1944ec8de750b49be144bb95de2a7e6f999aaffa11e6
SSDeep 12288:ImsAAxpN0fiD9C52ZqSLNW54KBysCc1TKb0gXLodd01sevie8grGz53LNxzSOL:ILLs0sgZqSLA1BysCc1GJXk8/Mb3LNz
TLSH D2F4127E4D862F15CA3D1EBDC4B318A433F1C403A252E7272EFC40F26AA7B564D62912
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d75b3be509fb4f8e936579f2f7ba968f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Bazregani.tegipica.spss
9asDGp3mg7S.Resources.resources
5d54e8b69e41d4.Resources.resources
ef9af4cc0
[NBF]root.Data
ef9af4cc1
[NBF]root.Data
ef9af4cc2
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
9asDGp3mg7S
Full Name
9asDGp3mg7S
EntryPoint
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Scope Name
9asDGp3mg7S
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
9asDGp3mg7S
Assembly Version
2.13.18.224
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Main IL Instruction Count
213
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003B: nop
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.0 <null>
ldloc.0 <null>
ldnull <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_13
br.s IL_0006: ldloc.s V_13
ldc.i4.3 <null>
br.s IL_004B: stloc.s V_13
nop <null>
ldc.i4 1426475833
ldc.i4 196
ldc.i4.1 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
newobj System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::wr7T4Gxq(System.Reflection.Assembly)
pop <null>
ldloc.1 <null>
nop <null>
ldc.i4 742133351
ldc.i4.3 <null>
ldc.i4.s 27
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::xEc5N6sz(System.String)
pop <null>
ldc.i4.6 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.1 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::eb7Z2oL()
pop <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1<System.Object> te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::Pd0mjKp1t6Q_Z()
stloc.2 <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_4
ldc.i4.s 9
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.s V_4
brfalse.s IL_00BE: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldc.i4.1 <null>
br.s IL_00B7: stloc.s V_13
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.2 <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
nop <null>
br.s IL_00D3: br.s IL_00D5
br.s IL_00D5: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010D: ldloc.2
ldloc.2 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Object> System.Collections.Generic.List`1<System.Object>::GetEnumerator()
stloc.s V_5
ldc.i4.6 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Object System.Collections.Generic.List`1/Enumerator<System.Object>::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0138: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldc.i4.2 <null>
br.s IL_0134: stloc.s V_15
ldc.i4.s 10
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
nop <null>
nop <null>
ldc.i4 1426475238
ldc.i4.6 <null>
ldc.i4.7 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
ldloc.s V_6
callvirt System.Type System.Object::GetType()
callvirt System.String System.Type::get_FullName()
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
ldc.i4.s 10
stloc.s V_15
br IL_00D8: ldloc.s V_15
nop <null>
ldc.i4.6 <null>
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Object>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_018E: ldc.i4.5
ldc.i4.s 9
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldc.i4.5 <null>
br.s IL_0187: stloc.s V_15
leave.s IL_01C4: br.s IL_01C6
br.s IL_0195: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B5: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Object>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_01C6: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01EE: ldloc.2
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0202: ldc.i4.2
ldc.i4.5 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
ldc.i4.2 <null>
br.s IL_01FE: stloc.s V_19
ldloc.2 <null>
call System.Void P_s6nf5TDcy4mL.Ric3zS8::cPe6dx5TH7kgd(System.Collections.Generic.List`1<System.Object>)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
nop <null>
leave.s IL_0266: br.s IL_0268
br.s IL_0217: br.s IL_0219
br.s IL_0219: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0238: br.s IL_023A
br.s IL_023A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
nop <null>
ldc.i4 742133365
ldc.i4.1 <null>
ldc.i4.3 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
ldloc.s V_11
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
br.s IL_025E: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0268: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0288: nop
nop <null>
ret <null>
ldtoken System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
pop <null>
ret <null>
Module Name
9asDGp3mg7S
Full Name
9asDGp3mg7S
EntryPoint
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Scope Name
9asDGp3mg7S
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
9asDGp3mg7S
Assembly Version
2.13.18.224
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
Main IL Instruction Count
213
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003B: nop
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.0 <null>
ldloc.0 <null>
ldnull <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_004F: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_13
br.s IL_0006: ldloc.s V_13
ldc.i4.3 <null>
br.s IL_004B: stloc.s V_13
nop <null>
ldc.i4 1426475833
ldc.i4 196
ldc.i4.1 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
newobj System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::wr7T4Gxq(System.Reflection.Assembly)
pop <null>
ldloc.1 <null>
nop <null>
ldc.i4 742133351
ldc.i4.3 <null>
ldc.i4.s 27
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::xEc5N6sz(System.String)
pop <null>
ldc.i4.6 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.1 <null>
callvirt te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::eb7Z2oL()
pop <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1<System.Object> te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M/Sj7k1qeXbBm0Y.mBk46ck::Pd0mjKp1t6Q_Z()
stloc.2 <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_4
ldc.i4.s 9
stloc.s V_13
br IL_0006: ldloc.s V_13
ldloc.s V_4
brfalse.s IL_00BE: ldc.i4.1
ldc.i4.0 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
ldc.i4.1 <null>
br.s IL_00B7: stloc.s V_13
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.2 <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_13
br IL_0006: ldloc.s V_13
nop <null>
br.s IL_00D3: br.s IL_00D5
br.s IL_00D5: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_010D: ldloc.2
ldloc.2 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Object> System.Collections.Generic.List`1<System.Object>::GetEnumerator()
stloc.s V_5
ldc.i4.6 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Object System.Collections.Generic.List`1/Enumerator<System.Object>::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0138: ldc.i4.2
ldc.i4.7 <null>
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
ldc.i4.2 <null>
br.s IL_0134: stloc.s V_15
ldc.i4.s 10
stloc.s V_15
br.s IL_00D8: ldloc.s V_15
nop <null>
nop <null>
ldc.i4 1426475238
ldc.i4.6 <null>
ldc.i4.7 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8/9WwfykC34bx.qi2TPet4d3aJ::db1F6r(System.Int32,System.Char,System.Int32)
ldloc.s V_6
callvirt System.Type System.Object::GetType()
callvirt System.String System.Type::get_FullName()
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
ldc.i4.s 10
stloc.s V_15
br IL_00D8: ldloc.s V_15
nop <null>
ldc.i4.6 <null>
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Object>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_018E: ldc.i4.5
ldc.i4.s 9
stloc.s V_15
br IL_00D8: ldloc.s V_15
ldc.i4.5 <null>
br.s IL_0187: stloc.s V_15
leave.s IL_01C4: br.s IL_01C6
br.s IL_0195: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B5: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Object>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_01C6: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_19
ldloc.s V_19
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01EE: ldloc.2
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0202: ldc.i4.2
ldc.i4.5 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
ldc.i4.2 <null>
br.s IL_01FE: stloc.s V_19
ldloc.2 <null>
call System.Void P_s6nf5TDcy4mL.Ric3zS8::cPe6dx5TH7kgd(System.Collections.Generic.List`1<System.Object>)
nop <null>
nop <null>
ldc.i4.2 <null>
stloc.s V_19
br.s IL_01C9: ldloc.s V_19
nop <null>
leave.s IL_0266: br.s IL_0268
br.s IL_0217: br.s IL_0219
br.s IL_0219: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0238: br.s IL_023A
br.s IL_023A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
nop <null>
ldc.i4 742133365
ldc.i4.1 <null>
ldc.i4.3 <null>
call System.String nBm36ddGyH4.Dk2xcoR6j8::7XcdGkc(System.Int32,System.Int32,System.Byte)
ldloc.s V_11
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Diagnostics.Debug::WriteLine(System.String)
br.s IL_025E: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0266: br.s IL_0268
br.s IL_0268: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0288: nop
nop <null>
ret <null>
ldtoken System.Void te7QqTp6Jr1wjG.fJj2n3Zz/Ld1w3beHdxZ.dPj3r4M::Yf3ignC()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙