Suspicious
Suspect

PE Executable
MD5: d8699a77398df73f03ff921207b94fe6
Size: 897.02 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d8699a77398df73f03ff921207b94fe6
Sha1 4df862a81950bc69bebbaf4eba3944d67b90dccf
Sha256 4e3a83b32bfb612a260f56d721464ef4aec86c8ea76495a2ff0bef8c1338837d
Sha384 c63f872ed6ac9d0341ca5cc2832e786e3a8674f78eb09bf2c6c426a7fa48cf5e59a0aeb20522d85a20e1319ad2732f3d
Sha512 9af8adee73b0375fe6f911ecec62e82b6cd27857f570c88c5822c8eeb74df124a73469a5697dad5ac8f25a0ac7fe63864c32cc2c3174a1e22cf25da0bed8e34f
SSDeep 12288:j2kwTPyG58L+QiQoAWjL7KcXdn+gbkNEQCvoGFvQGtY7/2kt8:jHwTP/AjonLGcXd+HEQCvoGFZY7N
TLSH D015BF62AE226B51EE3D5BBCC0D20C54D7F88D079301DA4FAFE832EA5977AC2C513911
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d8699a77398df73f03ff921207b94fe6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Zm3c5yyLAq.Resources.resources
Zm3c5yyLAq.g.resources
82bddafb9a1b31.Resources.resources
74e4c0920
[NBF]root.Data
74e4c0921
[NBF]root.Data
74e4c09210
[NBF]root.Data
74e4c09211
[NBF]root.Data
74e4c09212
[NBF]root.Data
74e4c09213
[NBF]root.Data
74e4c09214
[NBF]root.Data
74e4c09215
[NBF]root.Data
74e4c09216
[NBF]root.Data
74e4c09217
[NBF]root.Data
74e4c09218
[NBF]root.Data
74e4c09219
[NBF]root.Data
74e4c0922
[NBF]root.Data
74e4c09220
[NBF]root.Data
74e4c0923
[NBF]root.Data
74e4c0924
[NBF]root.Data
74e4c0925
[NBF]root.Data
74e4c0926
[NBF]root.Data
74e4c0927
[NBF]root.Data
74e4c0928
[NBF]root.Data
74e4c0929
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Zm3c5yyLAq
Full Name
Zm3c5yyLAq
EntryPoint
System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
Scope Name
Zm3c5yyLAq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zm3c5yyLAq
Assembly Version
29.27.15.63
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
Main IL Instruction Count
353
Main IL 
nop <null>
br.s IL_0003: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_008B: nop
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 20
ldc.i4 500
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.1 <null>
ldloc.1 <null>
stloc.s V_6
ldc.i4.s 9
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.s 22
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.s V_7
ldc.i4.2 <null>
sub <null>
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.s 30
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.2 <null>
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 15
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 10
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 14
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 19
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_13
ldloca.s V_13
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 917083400
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.Guid::ToString(System.String)
stloc.s V_8
ldc.i4.5 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
call System.Int32 System.Environment::get_ProcessorCount()
stloc.s V_9
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.s V_10
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
ldc.i4.s 11
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.3 <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.String System.Version::ToString()
stloc.s V_11
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.s 27
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 35
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldnull <null>
ldc.i4.2 <null>
ldc.i4 712470063
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
nop <null>
ldc.i4.7 <null>
ldnull <null>
ldc.i4 917083414
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_14
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_15
ldloc.s V_4
castclass System.Object[]
stloc.2 <null>
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
nop <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 712470023
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stloc.s V_16
ldloc.s V_16
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 917083424
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
nop <null>
ldnull <null>
ldc.i4.5 <null>
ldc.i4 712470038
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
nop <null>
ldc.i4.8 <null>
ldnull <null>
ldc.i4 917083449
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.String::Format(System.String,System.Object,System.Object,System.Object)
stloc.s V_5
ldc.i4.8 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_5
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_17
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] Zi8fyqK23.0LrmpsA5f6o/sZa7zr4SCx.Dxq48zG::Jj0f8(System.String)
stelem.ref <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
isinst System.Byte[]
brtrue.s IL_0298: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.7 <null>
br.s IL_0291: stloc.s V_26
ldc.i4.0 <null>
br.s IL_02A8: stloc.s V_18
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
ldlen <null>
conv.i4 <null>
stloc.s V_18
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Mgz70Hk.2fmAkS7tp8zG/6ayAn.Tir7kH8mY5/Wx1jg8iXxaT6.Lo5z6riE::Yo6wq7gMf(System.Byte[])
stelem.ref <null>
ldc.i4.1 <null>
stloc.s V_19
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldnull <null>
ldc.i4.5 <null>
ldc.i4 712470125
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 712470136
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
nop <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 712470135
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
stloc.s V_20
ldc.i4.s 28
stloc.s V_26
br IL_0006: ldloc.s V_26
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_22
ldloc.s V_22
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
ldc.i4.6 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.s V_22
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_22
stloc.s V_21
ldc.i4.s 20
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_21
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldloc.2 <null>
ldloc.s V_21
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Double Jx1z4.E_t9i7::bM_2ii(System.String,System.Object)
ldc.r8 0
cgt <null>
stloc.s V_23
ldc.i4.s 16
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_23
brfalse.s IL_0394: ldc.i4.s 21
ldc.i4.1 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.s 21
br.s IL_038D: stloc.s V_26
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 13
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_7
ldc.i4.s 22
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_7
ldloc.s V_6
ble.s IL_03DD: ldc.i4.s 12
ldc.i4.s 13
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.s 12
br.s IL_03D6: stloc.s V_26
leave.s IL_03F7: br.s IL_03F9
br.s IL_03E5: br.s IL_03E7
br.s IL_03E7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_24
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03F7: br.s IL_03F9
br.s IL_03F9: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0419: nop
nop <null>
ret <null>
ldtoken System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
pop <null>
ret <null>
Module Name
Zm3c5yyLAq
Full Name
Zm3c5yyLAq
EntryPoint
System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
Scope Name
Zm3c5yyLAq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zm3c5yyLAq
Assembly Version
29.27.15.63
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
Main IL Instruction Count
353
Main IL 
nop <null>
br.s IL_0003: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_008B: nop
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 20
ldc.i4 500
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.1 <null>
ldloc.1 <null>
stloc.s V_6
ldc.i4.s 9
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.s 22
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.s V_7
ldc.i4.2 <null>
sub <null>
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.s 30
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.2 <null>
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 15
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 10
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 14
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
br.s IL_00E8: stloc.s V_26
ldc.i4.s 19
br.s IL_00E8: stloc.s V_26
ldc.i4.s 25
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_13
ldloca.s V_13
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 917083400
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.Guid::ToString(System.String)
stloc.s V_8
ldc.i4.5 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
call System.Int32 System.Environment::get_ProcessorCount()
stloc.s V_9
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.s V_10
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
ldc.i4.s 11
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.3 <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.String System.Version::ToString()
stloc.s V_11
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.s 27
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 35
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldnull <null>
ldc.i4.2 <null>
ldc.i4 712470063
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
nop <null>
ldc.i4.7 <null>
ldnull <null>
ldc.i4 917083414
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_14
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_15
ldloc.s V_4
castclass System.Object[]
stloc.2 <null>
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
nop <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 712470023
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stloc.s V_16
ldloc.s V_16
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 917083424
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
nop <null>
ldnull <null>
ldc.i4.5 <null>
ldc.i4 712470038
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
nop <null>
ldc.i4.8 <null>
ldnull <null>
ldc.i4 917083449
call System.String eSr8xy3.4QcmSx_69::2Mrtfd0(System.Int32,eSr8xy3.4QcmSx_69,System.Int32)
call System.String System.String::Format(System.String,System.Object,System.Object,System.Object)
stloc.s V_5
ldc.i4.8 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_5
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_17
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] Zi8fyqK23.0LrmpsA5f6o/sZa7zr4SCx.Dxq48zG::Jj0f8(System.String)
stelem.ref <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
isinst System.Byte[]
brtrue.s IL_0298: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.7 <null>
br.s IL_0291: stloc.s V_26
ldc.i4.0 <null>
br.s IL_02A8: stloc.s V_18
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
ldlen <null>
conv.i4 <null>
stloc.s V_18
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Mgz70Hk.2fmAkS7tp8zG/6ayAn.Tir7kH8mY5/Wx1jg8iXxaT6.Lo5z6riE::Yo6wq7gMf(System.Byte[])
stelem.ref <null>
ldc.i4.1 <null>
stloc.s V_19
ldc.i4.s 29
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldnull <null>
ldc.i4.5 <null>
ldc.i4 712470125
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldnull <null>
ldc.i4.3 <null>
ldc.i4 712470136
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
nop <null>
ldnull <null>
ldc.i4.6 <null>
ldc.i4 712470135
call System.String Hcx2f3FmiJw7G.bb6NStj8wz4Ra/2QdexaL79j.k_2X6K::sk4Wm8TqBtm2(System.String,System.Int32,System.Int32)
stelem.ref <null>
stloc.s V_20
ldc.i4.s 28
stloc.s V_26
br IL_0006: ldloc.s V_26
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_22
ldloc.s V_22
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
ldc.i4.6 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldloc.s V_22
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_22
stloc.s V_21
ldc.i4.s 20
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_21
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldloc.2 <null>
ldloc.s V_21
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Double Jx1z4.E_t9i7::bM_2ii(System.String,System.Object)
ldc.r8 0
cgt <null>
stloc.s V_23
ldc.i4.s 16
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_23
brfalse.s IL_0394: ldc.i4.s 21
ldc.i4.1 <null>
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.s 21
br.s IL_038D: stloc.s V_26
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 13
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
nop <null>
ldc.i4.s 26
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_7
ldc.i4.s 22
stloc.s V_26
br IL_0006: ldloc.s V_26
ldloc.s V_7
ldloc.s V_6
ble.s IL_03DD: ldc.i4.s 12
ldc.i4.s 13
stloc.s V_26
br IL_0006: ldloc.s V_26
ldc.i4.s 12
br.s IL_03D6: stloc.s V_26
leave.s IL_03F7: br.s IL_03F9
br.s IL_03E5: br.s IL_03E7
br.s IL_03E7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_24
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03F7: br.s IL_03F9
br.s IL_03F9: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0419: nop
nop <null>
ret <null>
ldtoken System.Void Mgz70Hk.2fmAkS7tp8zG::Gem73()
pop <null>
ret <null>
d8699a77398df73f03ff921207b94fe6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Zm3c5yyLAq.Resources.resources
Zm3c5yyLAq.g.resources
82bddafb9a1b31.Resources.resources
74e4c0920
[NBF]root.Data
74e4c0921
[NBF]root.Data
74e4c09210
[NBF]root.Data
74e4c09211
[NBF]root.Data
74e4c09212
[NBF]root.Data
74e4c09213
[NBF]root.Data
74e4c09214
[NBF]root.Data
74e4c09215
[NBF]root.Data
74e4c09216
[NBF]root.Data
74e4c09217
[NBF]root.Data
74e4c09218
[NBF]root.Data
74e4c09219
[NBF]root.Data
74e4c0922
[NBF]root.Data
74e4c09220
[NBF]root.Data
74e4c0923
[NBF]root.Data
74e4c0924
[NBF]root.Data
74e4c0925
[NBF]root.Data
74e4c0926
[NBF]root.Data
74e4c0927
[NBF]root.Data
74e4c0928
[NBF]root.Data
74e4c0929
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙