Suspicious
Suspect

PE Executable
MD5: debc5451a1cba0528327f95daa19982f
Size: 3.61 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 debc5451a1cba0528327f95daa19982f
Sha1 e35f0b7f50b156887bdc6522cf895806390db9a3
Sha256 9d5a8515ee389bc2aeb83bfb6a0cea9a2bb4ef4b5dbff60b93ad6d4184f43a11
Sha384 81ece9e7e9215cefe4bbafdc2fe48b382b1b7755f4c346ba95ae946ac2e83ea62b4f75be4f8a98320fbd11422da0128a
Sha512 4d744519eac63e50366770799ea34d3f8cdfc0aa77f48a1d5da518f0908405a1d4457d5ca18250d9b92df1bd5aff80f302c9fd8f64f51bea1e2186b19ac2844e
SSDeep 49152:NGZUkVVB9Z7AMSVWpzROPBCx8RRveYkqM3fC41p2VEn:AVVN7AXWhROpCx8XGrqMvz1pmS
TLSH 6DF5F181A5C57994C5A63330F536460B33BAFE57E931C48D0C9EB8A1F3B728A5E870D6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
debc5451a1cba0528327f95daa19982f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0-preview.png
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
ID:0039
ID:0
ID:003A
ID:0
ID:003B
ID:0
RT_GROUP_CURSOR4
ID:008F
ID:0
RT_VERSION
ID:0001
ID:2052
.Net Resources
done.g.resources
done.Form1.resources
done.FrmHoaDonThue.resources
$this.Icon
[NBF]root.IconData
done.FrmMNBaocaobh.resources
_Command_0.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_Command_3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_cmd_0.Image
[NBF]root.Data
[NBF]root.Data-preview.png
4d71a3bba8f0b5.Resources.resources
2be1a30d0
[NBF]root.Data
2be1a30d1
[NBF]root.Data
2be1a30d10
[NBF]root.Data
2be1a30d11
[NBF]root.Data
2be1a30d12
[NBF]root.Data
2be1a30d13
[NBF]root.Data
2be1a30d14
[NBF]root.Data
2be1a30d15
[NBF]root.Data
2be1a30d16
[NBF]root.Data
2be1a30d17
[NBF]root.Data
2be1a30d18
[NBF]root.Data
2be1a30d19
[NBF]root.Data
2be1a30d2
[NBF]root.Data
2be1a30d20
[NBF]root.Data
2be1a30d21
[NBF]root.Data
2be1a30d22
[NBF]root.Data
2be1a30d23
[NBF]root.Data
2be1a30d24
[NBF]root.Data
2be1a30d25
[NBF]root.Data
2be1a30d26
[NBF]root.Data
2be1a30d27
[NBF]root.Data
2be1a30d28
[NBF]root.Data
2be1a30d29
[NBF]root.Data
2be1a30d3
[NBF]root.Data
2be1a30d30
[NBF]root.Data
2be1a30d31
[NBF]root.Data
2be1a30d32
[NBF]root.Data
2be1a30d33
[NBF]root.Data
2be1a30d34
[NBF]root.Data
2be1a30d35
[NBF]root.Data
2be1a30d36
[NBF]root.Data
2be1a30d37
[NBF]root.Data
2be1a30d38
[NBF]root.Data
2be1a30d39
[NBF]root.Data
2be1a30d4
[NBF]root.Data
2be1a30d40
[NBF]root.Data
2be1a30d41
[NBF]root.Data
2be1a30d5
[NBF]root.Data
2be1a30d6
[NBF]root.Data
2be1a30d7
[NBF]root.Data
2be1a30d8
[NBF]root.Data
2be1a30d9
[NBF]root.Data
Name Value
Module Name
done
Full Name
done
EntryPoint
System.Void Pm4w.e6X8::t0K2()
Scope Name
done
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
done
Assembly Version
2.7.11.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1329
Main Method
System.Void Pm4w.e6X8::t0K2()
Main IL Instruction Count
99
Main IL 
nop <null>
nop <null>
newobj System.Void Pm4w.To62::.ctor()
stloc.0 <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.3 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_4
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0043: ldloc.2
br.s IL_0060: ldloc.s V_4
ldloc.2 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Pm4w.To62
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Pm4w.To62
stloc.0 <null>
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
leave.s IL_00D7: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_5
nop <null>
nop <null>
ldc.i4 214
stloc.s V_6
br.s IL_00A2: ldloc.s V_6
ldloc.s V_6
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.s 24
cgt <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00A0: nop
ldc.i4.s 24
stloc.s V_6
ldstr resources/985674
call System.Byte[] Pm4w.Be40Ksp7::Ae31EpFm(System.String)
stloc.s V_7
nop <null>
nop <null>
nop <null>
ldloc.s V_6
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_9
ldloc.s V_9
brtrue.s IL_007D: ldloc.s V_6
ldloc.s V_7
castclass System.Byte[]
call System.Void Pm4w.To62::Hw38Lbo0(System.Byte[])
nop <null>
leave.s IL_00CF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CF: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D7: nop
nop <null>
ret <null>
Module Name
done
Full Name
done
EntryPoint
System.Void Pm4w.e6X8::t0K2()
Scope Name
done
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
done
Assembly Version
2.7.11.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1329
Main Method
System.Void Pm4w.e6X8::t0K2()
Main IL Instruction Count
99
Main IL 
nop <null>
nop <null>
newobj System.Void Pm4w.To62::.ctor()
stloc.0 <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.2 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.3 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_4
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0043: ldloc.2
br.s IL_0060: ldloc.s V_4
ldloc.2 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Pm4w.To62
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Pm4w.To62
stloc.0 <null>
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
leave.s IL_00D7: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_5
nop <null>
nop <null>
ldc.i4 214
stloc.s V_6
br.s IL_00A2: ldloc.s V_6
ldloc.s V_6
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.s 24
cgt <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00A0: nop
ldc.i4.s 24
stloc.s V_6
ldstr resources/985674
call System.Byte[] Pm4w.Be40Ksp7::Ae31EpFm(System.String)
stloc.s V_7
nop <null>
nop <null>
nop <null>
ldloc.s V_6
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_9
ldloc.s V_9
brtrue.s IL_007D: ldloc.s V_6
ldloc.s V_7
castclass System.Byte[]
call System.Void Pm4w.To62::Hw38Lbo0(System.Byte[])
nop <null>
leave.s IL_00CF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CF: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D7: nop
nop <null>
ret <null>
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #13 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #14 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
debc5451a1cba0528327f95daa19982f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0-preview.png
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
ID:0038
ID:0
ID:0039
ID:0
ID:003A
ID:0
ID:003B
ID:0
RT_GROUP_CURSOR4
ID:008F
ID:0
RT_VERSION
ID:0001
ID:2052
.Net Resources
done.g.resources
done.Form1.resources
done.FrmHoaDonThue.resources
$this.Icon
[NBF]root.IconData
done.FrmMNBaocaobh.resources
_Command_0.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_Command_3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_cmd_0.Image
[NBF]root.Data
[NBF]root.Data-preview.png
4d71a3bba8f0b5.Resources.resources
2be1a30d0
[NBF]root.Data
2be1a30d1
[NBF]root.Data
2be1a30d10
[NBF]root.Data
2be1a30d11
[NBF]root.Data
2be1a30d12
[NBF]root.Data
2be1a30d13
[NBF]root.Data
2be1a30d14
[NBF]root.Data
2be1a30d15
[NBF]root.Data
2be1a30d16
[NBF]root.Data
2be1a30d17
[NBF]root.Data
2be1a30d18
[NBF]root.Data
2be1a30d19
[NBF]root.Data
2be1a30d2
[NBF]root.Data
2be1a30d20
[NBF]root.Data
2be1a30d21
[NBF]root.Data
2be1a30d22
[NBF]root.Data
2be1a30d23
[NBF]root.Data
2be1a30d24
[NBF]root.Data
2be1a30d25
[NBF]root.Data
2be1a30d26
[NBF]root.Data
2be1a30d27
[NBF]root.Data
2be1a30d28
[NBF]root.Data
2be1a30d29
[NBF]root.Data
2be1a30d3
[NBF]root.Data
2be1a30d30
[NBF]root.Data
2be1a30d31
[NBF]root.Data
2be1a30d32
[NBF]root.Data
2be1a30d33
[NBF]root.Data
2be1a30d34
[NBF]root.Data
2be1a30d35
[NBF]root.Data
2be1a30d36
[NBF]root.Data
2be1a30d37
[NBF]root.Data
2be1a30d38
[NBF]root.Data
2be1a30d39
[NBF]root.Data
2be1a30d4
[NBF]root.Data
2be1a30d40
[NBF]root.Data
2be1a30d41
[NBF]root.Data
2be1a30d5
[NBF]root.Data
2be1a30d6
[NBF]root.Data
2be1a30d7
[NBF]root.Data
2be1a30d8
[NBF]root.Data
2be1a30d9
[NBF]root.Data
No malware configuration was found at this point.
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #12 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #13 URIsuspect
http:/huhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
URLs in VB Code - #14 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
debc5451a1cba0528327f95daa19982f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙