Malicious PE Executable analysis – e4e90cce3c11

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Very high

1 malicious · 6 files

EXEe4e90cce3c11100b08e94fcd3e3c9440

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	tmpTLF0058634182updater.exe
Full Name	tmpTLF0058634182updater.exe
EntryPoint	System.Void lwVY3gfMLi0svEjayF.iCbVQSipayKWbR2JXk::qA1tkRo0R()
Scope Name	tmpTLF0058634182updater.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tmpTLF0058634182updater
Assembly Version	4.9.1.54
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	39
Main Method	System.Void lwVY3gfMLi0svEjayF.iCbVQSipayKWbR2JXk::qA1tkRo0R()
Main IL Instruction Count	42
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0043: ldsfld qGrkjeQ0ipQmp2egjxc qGrkjeQ0ipQmp2egjxc::n8lQkDhdiX call System.Void YyuVhF9iIPleKIim7Tr.vQSatq9UsGHFJiMAwyu::xY8LP31ZEf() ldc.i4 3 br IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) ldsfld qGrkjeQ0ipQmp2egjxc qGrkjeQ0ipQmp2egjxc::n8lQkDhdiX call System.Void qGrkjeQ0ipQmp2egjxc::iJ9rXXn1RK(qGrkjeQ0ipQmp2egjxc) ldc.i4 0 ldsfld <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f} <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_e6e3037c7b714814b23fdc5326e85fca ldfld System.Int32 <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_322bf30448434501b2b4f58e06f87adb brfalse IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) pop <null> ldc.i4 2 br IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) call System.Void jrKw7j9X6VMyA0abk3w.nScA6m9lO838qHv7Ht7::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 0 ldsfld <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f} <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_e6e3037c7b714814b23fdc5326e85fca ldfld System.Int32 <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_5fa17c65fbf04cf1937832605c3658b5 brtrue IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) pop <null> ldc.i4 0 br IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) newobj System.Void RfhsNdjgujwop.Bhfhr9ol::.ctor() ldsfld qrmqSkQHccoSlqKC6EY qrmqSkQHccoSlqKC6EY::DfcQRYrDF9 call System.Void qrmqSkQHccoSlqKC6EY::iJ9rXXn1RK(System.Windows.Forms.Form,qrmqSkQHccoSlqKC6EY) ldc.i4 1 ldsfld <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f} <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_e6e3037c7b714814b23fdc5326e85fca ldfld System.Int32 <Module>{618b2a21-bc6a-4836-87fd-02a8944a156f}::m_57d3daf5aaf64ae7b023411bf67732ed brtrue IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) pop <null> ldc.i4 4 br IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) ldc.i4.0 <null> ldsfld zK5WSMQeM4qpIg1k4yX zK5WSMQeM4qpIg1k4yX::PvGQqVTpus call System.Void zK5WSMQeM4qpIg1k4yX::iJ9rXXn1RK(System.Boolean,zK5WSMQeM4qpIg1k4yX) ldc.i4 5 br IL_0012: switch(IL_0043,IL_006C,IL_00BE,IL_0090,IL_00D3,IL_0034) ret <null>