Malicious
Malicious

PE Executable
MD5: e480e6e977f641b1a85d7a5f2de184b0
Size: 3.77 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 e480e6e977f641b1a85d7a5f2de184b0
Sha1 372ba4d290705e67e693d80883806e9d1362e94d
Sha256 a9d75ed3310af93ae5f009feddf41f2b75fb20414ed6b323970d33942f7808b8
Sha384 2f4b3e69ec71af458298ba31a4bb190d3010d0c4565b6bb70a854b61bc5a69f65446801b7a6b756679bcbcc94f7eff53
Sha512 3fdca5af458efc65ce129be0f131c9d5a4544c702352bba8be8619fa9a346d50708ee042895d390d6c488d174c4b96cb4566602a6c4640cdeed89d9f49d07a64
SSDeep 98304:JVI6WScmLPp6YHwDc9g0XST3dcyXV2ElC:JVIdaLPUDigL1
TLSH 0E06F10665E28E37C2621B318597023E9391D3233552EF1B356F90C3A85B7F69EB61B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
e480e6e977f641b1a85d7a5f2de184b0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ghtSwFb7AvDntcGE0Y.jRotfnDR9CW8T9ippf
l4h2rojO2EP3WjTt3R.VTaYeHIxoUWlW507cR
RQckbcJEq4eqICVhE2.qo15pZ1V3kOmyOoOQa
agbNHcteVLI2tmYr1J.TB7unrpnT8opd6O41m
eZyQBrqMQvVYL7qdrT.SbJ4mh9FrFRa63oagc
ZFFhHiAfJpT9INvaU6.nmlsXUVppKcKMQtfIq
Name Value
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void fdM56nW9qqenpaEN6Qd.U2NpgWWqt6iUBg3cJbv::tPAWjeeCrc()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void fdM56nW9qqenpaEN6Qd.U2NpgWWqt6iUBg3cJbv::tPAWjeeCrc()
Main IL Instruction Count
46
Main IL 
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0084: ldnull
ldc.i4 1509636802
ldc.i4 1852732006
xor <null>
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_944c2e0301ee4728af4bf7182150a117
xor <null>
call System.String kJafiAhHKdcr7lw5FWb.LQZgc7hcpMWU6FTgjj8::LPZhOFwsLg(System.Int32)
newobj System.Void z43SFe1toO8N6c1Smd2.UgMxwo1DNv3YldqBWic::.ctor(System.String)
call System.Void z43SFe1toO8N6c1Smd2.UgMxwo1DNv3YldqBWic::T131p4qmfd()
ldc.i4 1
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_82d45d57e3f64247bb10af1eda203477
brfalse IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
ret <null>
call System.Void tPtameY2EpKSqFstQH3.kaanx1YH23qDDcTUx6v::KAQVI51J1pC()
ldc.i4 3
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
ldnull <null>
ldnull <null>
newobj System.Void rZoUoU9yYKMD2ubnWyS.C8ARJ99Zi9DWAbRtejk::.ctor(System.String,System.String)
call System.Void GQ0Q65VEbO8Ea8xwGI1.Bi7yCoVWJht2KbC2Fdm::IOAVUAgp3k(rZoUoU9yYKMD2ubnWyS.C8ARJ99Zi9DWAbRtejk)
ldc.i4 0
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_44cbf1ce96e045b180d9a6b391e439c3
brtrue IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
newobj System.Void vUDdqHJDykuVtmfSTpq.i5OCK1JbGmnMP9nGr83::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_95754d8f9c3947248201f9802c2821ff
brtrue IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void fdM56nW9qqenpaEN6Qd.U2NpgWWqt6iUBg3cJbv::tPAWjeeCrc()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void fdM56nW9qqenpaEN6Qd.U2NpgWWqt6iUBg3cJbv::tPAWjeeCrc()
Main IL Instruction Count
46
Main IL 
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0084: ldnull
ldc.i4 1509636802
ldc.i4 1852732006
xor <null>
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_944c2e0301ee4728af4bf7182150a117
xor <null>
call System.String kJafiAhHKdcr7lw5FWb.LQZgc7hcpMWU6FTgjj8::LPZhOFwsLg(System.Int32)
newobj System.Void z43SFe1toO8N6c1Smd2.UgMxwo1DNv3YldqBWic::.ctor(System.String)
call System.Void z43SFe1toO8N6c1Smd2.UgMxwo1DNv3YldqBWic::T131p4qmfd()
ldc.i4 1
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_82d45d57e3f64247bb10af1eda203477
brfalse IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
ret <null>
call System.Void tPtameY2EpKSqFstQH3.kaanx1YH23qDDcTUx6v::KAQVI51J1pC()
ldc.i4 3
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
ldnull <null>
ldnull <null>
newobj System.Void rZoUoU9yYKMD2ubnWyS.C8ARJ99Zi9DWAbRtejk::.ctor(System.String,System.String)
call System.Void GQ0Q65VEbO8Ea8xwGI1.Bi7yCoVWJht2KbC2Fdm::IOAVUAgp3k(rZoUoU9yYKMD2ubnWyS.C8ARJ99Zi9DWAbRtejk)
ldc.i4 0
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_44cbf1ce96e045b180d9a6b391e439c3
brtrue IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
newobj System.Void vUDdqHJDykuVtmfSTpq.i5OCK1JbGmnMP9nGr83::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34} <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_096ca7ff0c0446098b2bb4f8f34dd181
ldfld System.Int32 <Module>{01fa1d31-e186-416d-8fb4-74c74c91fc34}::m_95754d8f9c3947248201f9802c2821ff
brtrue IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0084,IL_0074,IL_0030,IL_00AF,IL_0075)
e480e6e977f641b1a85d7a5f2de184b0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ghtSwFb7AvDntcGE0Y.jRotfnDR9CW8T9ippf
l4h2rojO2EP3WjTt3R.VTaYeHIxoUWlW507cR
RQckbcJEq4eqICVhE2.qo15pZ1V3kOmyOoOQa
agbNHcteVLI2tmYr1J.TB7unrpnT8opd6O41m
eZyQBrqMQvVYL7qdrT.SbJ4mh9FrFRa63oagc
ZFFhHiAfJpT9INvaU6.nmlsXUVppKcKMQtfIq
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙