Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: de9fe81dd0a1a61b02dbc84cd5479535
Size: 1.72 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 de9fe81dd0a1a61b02dbc84cd5479535
Sha1 916544a5d4c48b2a36da93c6c7a13ee582e33e6b
Sha256 94d3ea79f8c5ca711431010276ec84db1eab20e8d33f2c2293e8f3347d378adf
Sha384 3165235954dfab15b5ffac5b2216526cc3edaee432c5f3429071440d4c0e3d658b63cbe1d119a8a419f2657853418bea
Sha512 acfed19dbdf2e1b3a032f78e5add768043d34a1fbe51dfbacabbedf5982c401a435239046f79a107ba7e455b4e43ba6082a0899cec692f78dde00bd123d2a104
SSDeep 49152:0rhGflnXlXnm3pyw1XfUXngXjAGslTF2euhA:0r2nXZqp5f0Pueu
TLSH BA85230BF94FC2B0C2909BBAC4EA869503B9C740E657DC5B79FA278E16137FD8940587
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL
de9fe81dd0a1a61b02dbc84cd5479535
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ghwvvdxhqpk.Properties.Resources.resources
Yfseychtsgv
TimeZoneConverter.Data.Aliases.csv.gz
file_0.bin
TimeZoneConverter.Data.Mapping.csv.gz
file_0.bin
TimeZoneConverter.Data.RailsMapping.csv.gz
file_0.bin
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
newAI_crypted.exe
Full Name
newAI_crypted.exe
EntryPoint
System.Void newAI_crypted.Networking.SorterModule::CloseGeneralConnection()
Scope Name
newAI_crypted.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
newAI_crypted
Assembly Version
1.0.4634.4486
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
82
Main Method
System.Void newAI_crypted.Networking.SorterModule::CloseGeneralConnection()
Main IL Instruction Count
137
Main IL 
ldc.i4 7
stloc V_8
br IL_000E: ldloc V_8
ldloc V_8
switch dnlib.DotNet.Emit.Instruction[]
br IL_0040: newobj System.Void newAI_crypted.Verification.VerifierAnalyzer::.ctor()
newobj System.Void newAI_crypted.Verification.VerifierAnalyzer::.ctor()
stloc.s V_2
ldc.i4 5
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
nop <null>
nop <null>
ldloc.s V_7
ldloc.s V_6
ldftn System.Void Ghwvvdxhqpk.Drivers.DriverAllocator::ForceTransformableDriver(System.Object,Ghwvvdxhqpk.Location.IterableLocator)
newobj System.Void System.EventHandler`1<Ghwvvdxhqpk.Location.IterableLocator>::.ctor(System.Object,System.IntPtr)
callvirt System.Void newAI_crypted.Roles.RoleCompressor::EvaluateRole(System.EventHandler`1<Ghwvvdxhqpk.Location.IterableLocator>)
ldc.i4 2
br IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0093: nop
nop <null>
ldloc.s V_7
callvirt System.Void newAI_crypted.Roles.RoleCompressor::QueryRole()
ldc.i4 3
br IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
nop <null>
ldloc.s V_4
ldloc.s V_6
ldftn System.Void Ghwvvdxhqpk.Drivers.DriverAllocator::AttachDriver(System.Object,newAI_crypted.Finalization.FinalizerBridge)
newobj System.Void System.EventHandler`1<newAI_crypted.Finalization.FinalizerBridge>::.ctor(System.Object,System.IntPtr)
callvirt System.Void newAI_crypted.Roles.StaticRole::ChangeRole(System.EventHandler`1<newAI_crypted.Finalization.FinalizerBridge>)
ldc.i4 0
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_76a5d2fd39684637929e9b0feecbb35b
brtrue IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
pop <null>
ldc.i4 0
br IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
nop <null>
ldloc.s V_3
ldloc.s V_6
ldftn System.Void Ghwvvdxhqpk.Drivers.DriverAllocator::RunTransferableDriver(System.Object,Ghwvvdxhqpk.Compilers.GlobalCompiler)
newobj System.Void System.EventHandler`1<Ghwvvdxhqpk.Compilers.GlobalCompiler>::.ctor(System.Object,System.IntPtr)
callvirt System.Void newAI_crypted.Visitors.DynamicVisitor::VisitIntegratedVisitor(System.EventHandler`1<Ghwvvdxhqpk.Compilers.GlobalCompiler>)
ldc.i4 4
br IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
nop <null>
ldloc.s V_2
ldloc.s V_6
ldftn System.Void Ghwvvdxhqpk.Drivers.DriverAllocator::FormatDriver(System.Object,newAI_crypted.Visitors.ConnectedVisitor)
newobj System.Void System.EventHandler`1<newAI_crypted.Visitors.ConnectedVisitor>::.ctor(System.Object,System.IntPtr)
callvirt System.Void newAI_crypted.Verification.VerifierAnalyzer::ValidateCustomVerifier(System.EventHandler`1<newAI_crypted.Visitors.ConnectedVisitor>)
ldc.i4 1
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_b17435f6a52542a298b404ca69b102ed
brtrue IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
pop <null>
ldc.i4 0
br IL_0075: switch(IL_0093,IL_00D9,IL_00F8,IL_012C,IL_00A5)
nop <null>
nop <null>
leave IL_01CD: ret
ldloc.s V_6
brfalse IL_0196: endfinally
ldc.i4 0
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_00e73bf1bf2d4b708095f9ef286ae1c4
brfalse IL_015D: switch(IL_0195,IL_016F)
pop <null>
ldc.i4 1
br IL_015D: switch(IL_0195,IL_016F)
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
br IL_0195: nop
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_76a5d2fd39684637929e9b0feecbb35b
brtrue IL_015D: switch(IL_0195,IL_016F)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0195,IL_016F)
nop <null>
endfinally <null>
ldc.i4 1
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_3cab821d6b044a098e162a5b80b10fa2
brtrue IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
ldloc.s V_2
ldloc.s V_3
ldloc.s V_4
newobj System.Void Ghwvvdxhqpk.Drivers.DriverAllocator::.ctor(newAI_crypted.Verification.VerifierAnalyzer,newAI_crypted.Visitors.DynamicVisitor,newAI_crypted.Roles.StaticRole)
stloc.s V_6
ldc.i4 8
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
ret <null>
ldnull <null>
ldloc.s V_0
newobj System.Void newAI_crypted.Roles.RoleCompressor::.ctor(System.String,System.Version)
stloc.s V_7
ldc.i4 0
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_28a9c2d10286444ebfb31d867c06cbfb
brtrue IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
newobj System.Void newAI_crypted.Roles.StaticRole::.ctor()
stloc.s V_4
ldc.i4 0
ldsfld <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63} <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_7083c69c7f2e40259314cb294c2cec7f
ldfld System.Int32 <Module>{e609ab33-60e2-4c76-ae15-6cf27a52bf63}::m_453d130c975c441f8bb0ba4c8192270d
brtrue IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
nop <null>
ldc.i4 4032
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4 6
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
newobj System.Void newAI_crypted.Visitors.DynamicVisitor::.ctor()
stloc.s V_3
ldc.i4 4
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
nop <null>
ldstr 1.4.1
newobj System.Void System.Version::.ctor(System.String)
stloc.s V_0
ldc.i4 2
br IL_0012: switch(IL_0040,IL_01CD,IL_01CE,IL_01B6,IL_01F7,IL_0232,IL_0243,IL_021D,IL_0051)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙