Suspicious
Suspect

df9020f28054439079ed3173237da673

PE Executable
MD5: df9020f28054439079ed3173237da673
Size: 593.41 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 df9020f28054439079ed3173237da673
Sha1 9345dceefab1a37babd76257c6dca2541dee49cf
Sha256 e344fe526e15e7a798d965e12fa66bbae99c620e2bac85cea2cf39da91e1c2a9
Sha384 6ef3a548aeb3bcd18bfda7931e976474c83035c8938f8a4fdac85f37248ec37f59eaaf8c1775cb35307de75fbc4ff7ba
Sha512 91afc743fe79577c54f1c8fa753236f37bc28a22bd0947b9a36ece223129c8262043d1c074414f22ea2cbc80b56f0ca7d105dff4164fead3cac976e38d2760dc
SSDeep 6144:QIXV1lR5hIiZ3PGNzTgLJl512oJsDg5kGAM1c6E+1hKYTq8uqBzuZKaTAubpEX3a:NV1l/rZ3PGN050omh69b9zuCubNh+/a
TLSH 52C49C5833EA9244E17FA7398E764A004BF0F913CA32C61FE69714ED8B6679455233A3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
df9020f28054439079ed3173237da673
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
0MgnWad4.g.resources
0MgnWad4.Resources.resources
a4c29fab8ffa7a.Resources.resources
b89540740
[NBF]root.Data
b89540741
[NBF]root.Data
b89540742
[NBF]root.Data
b89540743
[NBF]root.Data
b89540744
[NBF]root.Data
b89540745
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
0MgnWad4
Full Name
0MgnWad4
EntryPoint
System.Void 0MgnWad4.2NynCa1a::Wrf1ii8N3Jgybj()
Scope Name
0MgnWad4
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0MgnWad4
Assembly Version
5.2.23.110
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void 0MgnWad4.2NynCa1a::Wrf1ii8N3Jgybj()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void 0MgnWad4.2NynCa1a::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken 0MgnWad4.2NynCa1a
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass 0MgnWad4.2NynCa1a
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] 0MgnWad4.Kd8w1::6gwAmyG9Bj(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void 0MgnWad4.2GsmtoS9H5sbgp/7Kmgd.7Kis_b8YH6tcx::yHc34dQpy1b(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
Module Name
0MgnWad4
Full Name
0MgnWad4
EntryPoint
System.Void 0MgnWad4.2NynCa1a::Wrf1ii8N3Jgybj()
Scope Name
0MgnWad4
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0MgnWad4
Assembly Version
5.2.23.110
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void 0MgnWad4.2NynCa1a::Wrf1ii8N3Jgybj()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void 0MgnWad4.2NynCa1a::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken 0MgnWad4.2NynCa1a
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass 0MgnWad4.2NynCa1a
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] 0MgnWad4.Kd8w1::6gwAmyG9Bj(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void 0MgnWad4.2GsmtoS9H5sbgp/7Kmgd.7Kis_b8YH6tcx::yHc34dQpy1b(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
df9020f28054439079ed3173237da673
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
0MgnWad4.g.resources
0MgnWad4.Resources.resources
a4c29fab8ffa7a.Resources.resources
b89540740
[NBF]root.Data
b89540741
[NBF]root.Data
b89540742
[NBF]root.Data
b89540743
[NBF]root.Data
b89540744
[NBF]root.Data
b89540745
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙