Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e02cb6e561544032a40aaba15543c004
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
dMQ87tscQ0ptN04xlo.Hl6g8LlGR10clcmEcV
33urKfVFjjJSmOfZKq.InchVg0AS3SwErrhkp
jrs5pgockpvyWQxtHa.dqPDr6agS1FxtJjnIi
P2oAKNO4CAWylxZL8Y.fx2GGGJ9SM3wl641JK
9pKpUKe84b3DCvChfs.tTfoeZWa9VgImvq9DJ
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
IIe.exe
Full Name
IIe.exe
EntryPoint
System.Void DNg4hYfNL8JrxRBF1b.xDNJ0jAoTMbdEtbCG1::SrtFQdwuW()
Scope Name
IIe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
IIe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
43
Main Method
System.Void DNg4hYfNL8JrxRBF1b.xDNJ0jAoTMbdEtbCG1::SrtFQdwuW()
Main IL Instruction Count
53
Main IL 
br.s IL_0007: ldc.i4 5
call <null>
ldc.i4 5
stloc V_0
br IL_0015: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0065: call System.Void PSSUskJKCZqQpFLI55c.POwtgnJZq4m5w6yRxgY::TcEq0TlrKC()
nop <null>
ldsfld v0dRZl0kbgFP2rnUmyL v0dRZl0kbgFP2rnUmyL::h8k0rs1FWP
call System.Void v0dRZl0kbgFP2rnUmyL::Vyy0Vnq0Dw(v0dRZl0kbgFP2rnUmyL)
ldc.i4 1
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_8625ab599fe946cb8dbc94b6f0943ed5
brtrue IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 1
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
call System.Void PSSUskJKCZqQpFLI55c.POwtgnJZq4m5w6yRxgY::TcEq0TlrKC()
ldc.i4 3
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_45fa593f40974a349e7b7a9a58829132
brfalse IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 3
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
ret <null>
call System.Void zvx8s3J49OsLPYXNJHc.wRvaYdJDADNQ0kSLM6Q::zjjpHjX31C()
ldc.i4 4
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
newobj System.Void OptogeneticsApp.Form1::.ctor()
ldsfld KhtL4p0Po5weIsH5hOg KhtL4p0Po5weIsH5hOg::jP30bkWdmV
call System.Void KhtL4p0Po5weIsH5hOg::Vyy0Vnq0Dw(System.Windows.Forms.Form,KhtL4p0Po5weIsH5hOg)
ldc.i4 2
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_1994a9bde76c49a4852d5a7bc5a72ca3
brfalse IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 2
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
ldc.i4.0 <null>
ldsfld aIr50X0gQ63NO0rQ2xL aIr50X0gQ63NO0rQ2xL::HTu0cO2J9R
call System.Void aIr50X0gQ63NO0rQ2xL::Vyy0Vnq0Dw(System.Boolean,aIr50X0gQ63NO0rQ2xL)
ldc.i4 0
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_6fddbbad9fa74f4fa0d0fbdcf3ff6fb9
brtrue IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
Module Name
IIe.exe
Full Name
IIe.exe
EntryPoint
System.Void DNg4hYfNL8JrxRBF1b.xDNJ0jAoTMbdEtbCG1::SrtFQdwuW()
Scope Name
IIe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
IIe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
43
Main Method
System.Void DNg4hYfNL8JrxRBF1b.xDNJ0jAoTMbdEtbCG1::SrtFQdwuW()
Main IL Instruction Count
53
Main IL 
br.s IL_0007: ldc.i4 5
call <null>
ldc.i4 5
stloc V_0
br IL_0015: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0065: call System.Void PSSUskJKCZqQpFLI55c.POwtgnJZq4m5w6yRxgY::TcEq0TlrKC()
nop <null>
ldsfld v0dRZl0kbgFP2rnUmyL v0dRZl0kbgFP2rnUmyL::h8k0rs1FWP
call System.Void v0dRZl0kbgFP2rnUmyL::Vyy0Vnq0Dw(v0dRZl0kbgFP2rnUmyL)
ldc.i4 1
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_8625ab599fe946cb8dbc94b6f0943ed5
brtrue IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 1
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
call System.Void PSSUskJKCZqQpFLI55c.POwtgnJZq4m5w6yRxgY::TcEq0TlrKC()
ldc.i4 3
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_45fa593f40974a349e7b7a9a58829132
brfalse IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 3
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
ret <null>
call System.Void zvx8s3J49OsLPYXNJHc.wRvaYdJDADNQ0kSLM6Q::zjjpHjX31C()
ldc.i4 4
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
newobj System.Void OptogeneticsApp.Form1::.ctor()
ldsfld KhtL4p0Po5weIsH5hOg KhtL4p0Po5weIsH5hOg::jP30bkWdmV
call System.Void KhtL4p0Po5weIsH5hOg::Vyy0Vnq0Dw(System.Windows.Forms.Form,KhtL4p0Po5weIsH5hOg)
ldc.i4 2
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_1994a9bde76c49a4852d5a7bc5a72ca3
brfalse IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 2
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
nop <null>
ldc.i4.0 <null>
ldsfld aIr50X0gQ63NO0rQ2xL aIr50X0gQ63NO0rQ2xL::HTu0cO2J9R
call System.Void aIr50X0gQ63NO0rQ2xL::Vyy0Vnq0Dw(System.Boolean,aIr50X0gQ63NO0rQ2xL)
ldc.i4 0
ldsfld <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374} <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_a438c0cb8a1b43fb903375112ed02392
ldfld System.Int32 <Module>{3fefd32b-139c-4bff-b6b4-7f960803b374}::m_6fddbbad9fa74f4fa0d0fbdcf3ff6fb9
brtrue IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_0065,IL_00C9,IL_0089,IL_009A,IL_003B,IL_008B)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙