Malicious PE Executable analysis – d7aa25008637

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 5 files

EXEd7aa250086373b06280ad19ff661403d

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Xvttcleosch.exe
Full Name	Xvttcleosch.exe
EntryPoint	System.Void HidSharp.Strategies.RequestProxy::ReflectStrategy()
Scope Name	Xvttcleosch.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Xvttcleosch
Assembly Version	1.0.9108.3457
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Strategies.RequestProxy::ReflectStrategy()
Main IL Instruction Count	32
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Strategies.RequestProxy/<>c HidSharp.Strategies.RequestProxy/<>c::sortedGateway ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Strategies.RequestProxy/<>c::_CommonCompiler dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Strategies.RequestProxy::CheckStrategy(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2} <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_86fd85fa9c074095936060c462307358 ldfld System.Int32 <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_c6ec505ebd744b0bbeb77b1f8bca744c brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Strategies.RequestProxy/<>c HidSharp.Strategies.RequestProxy/<>c::sortedGateway ldftn System.Void HidSharp.Strategies.RequestProxy/<>c::DecompressAdapter(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Strategies.RequestProxy/<>c::_CommonCompiler call System.Void HidSharp.Strategies.RequestProxy::CheckStrategy(System.Action`1<System.IO.MemoryStream>) ldc.i4 2 ldsfld <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2} <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_86fd85fa9c074095936060c462307358 ldfld System.Int32 <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_53e54827259c41da9ccd8251d75e8371 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 1 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name	Xvttcleosch.exe
Full Name	Xvttcleosch.exe
EntryPoint	System.Void HidSharp.Strategies.RequestProxy::ReflectStrategy()
Scope Name	Xvttcleosch.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Xvttcleosch
Assembly Version	1.0.9108.3457
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Strategies.RequestProxy::ReflectStrategy()
Main IL Instruction Count	32
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Strategies.RequestProxy/<>c HidSharp.Strategies.RequestProxy/<>c::sortedGateway ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Strategies.RequestProxy/<>c::_CommonCompiler dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Strategies.RequestProxy::CheckStrategy(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2} <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_86fd85fa9c074095936060c462307358 ldfld System.Int32 <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_c6ec505ebd744b0bbeb77b1f8bca744c brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Strategies.RequestProxy/<>c HidSharp.Strategies.RequestProxy/<>c::sortedGateway ldftn System.Void HidSharp.Strategies.RequestProxy/<>c::DecompressAdapter(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Strategies.RequestProxy/<>c::_CommonCompiler call System.Void HidSharp.Strategies.RequestProxy::CheckStrategy(System.Action`1<System.IO.MemoryStream>) ldc.i4 2 ldsfld <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2} <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_86fd85fa9c074095936060c462307358 ldfld System.Int32 <Module>{b7380e37-04a6-44de-b7d1-acfd27585ee2}::m_53e54827259c41da9ccd8251d75e8371 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 1 br IL_0012: switch(IL_0059,IL_0029,IL_0028)