Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 2 files
EXEeba50d754296560001814f8bb26c0e72
Structure
Name Value
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void h2IllLycuDYnOCr3vJC.gdUooVyZE5OcvDryEjw::oL1yCwJrKL()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void h2IllLycuDYnOCr3vJC.gdUooVyZE5OcvDryEjw::oL1yCwJrKL()
Main IL Instruction Count
43
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_008B: ldnull
newobj System.Void htrJsIfP2ToQY70kQtq.WygjKyfAg3VbfCjtsdA::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_41605fd10b42456aa82973962f30c197
brtrue IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
ldc.i4 637387814
ldc.i4 -2113299036
add <null>
ldc.i4 -2064231358
xor <null>
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_f51100cf5100456a82a90139b1bfb475
xor <null>
call System.String XxcZploF8NPmNyotNji.hlRkwZobqRdku1IsSAU::k6IoRY7FBs(System.Int32)
newobj System.Void pGHEAsrTJtXc6Pi13Nk.TqxcDarPfoWPKfcnj5f::.ctor(System.String)
call System.Void pGHEAsrTJtXc6Pi13Nk.TqxcDarPfoWPKfcnj5f::vdtrxI9sQH()
ldc.i4 4
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void UXqfVOcGOB0d77WxRum.bJ6mPAcLM7G1jd3NlTx::.ctor(System.String,System.String)
call System.Void PhAXRjsXpZ2FhvWFpaj.fYTiu9syxrQ0R8AyjL5::IWcsUFvmss(UXqfVOcGOB0d77WxRum.bJ6mPAcLM7G1jd3NlTx)
ldc.i4 3
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
call System.Void xKGs5J1VwnP5NAGkD0D.iJ33Z51Fpoj60iurpAp::w7usfALqXdS()
ldc.i4 0
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_39de36e6da93430bbf0cb916f69cbe56
brtrue IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void h2IllLycuDYnOCr3vJC.gdUooVyZE5OcvDryEjw::oL1yCwJrKL()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void h2IllLycuDYnOCr3vJC.gdUooVyZE5OcvDryEjw::oL1yCwJrKL()
Main IL Instruction Count
43
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_008B: ldnull
newobj System.Void htrJsIfP2ToQY70kQtq.WygjKyfAg3VbfCjtsdA::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_41605fd10b42456aa82973962f30c197
brtrue IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
ldc.i4 637387814
ldc.i4 -2113299036
add <null>
ldc.i4 -2064231358
xor <null>
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_f51100cf5100456a82a90139b1bfb475
xor <null>
call System.String XxcZploF8NPmNyotNji.hlRkwZobqRdku1IsSAU::k6IoRY7FBs(System.Int32)
newobj System.Void pGHEAsrTJtXc6Pi13Nk.TqxcDarPfoWPKfcnj5f::.ctor(System.String)
call System.Void pGHEAsrTJtXc6Pi13Nk.TqxcDarPfoWPKfcnj5f::vdtrxI9sQH()
ldc.i4 4
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void UXqfVOcGOB0d77WxRum.bJ6mPAcLM7G1jd3NlTx::.ctor(System.String,System.String)
call System.Void PhAXRjsXpZ2FhvWFpaj.fYTiu9syxrQ0R8AyjL5::IWcsUFvmss(UXqfVOcGOB0d77WxRum.bJ6mPAcLM7G1jd3NlTx)
ldc.i4 3
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
call System.Void xKGs5J1VwnP5NAGkD0D.iJ33Z51Fpoj60iurpAp::w7usfALqXdS()
ldc.i4 0
ldsfld <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6} <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_b55fac1e7259404a901d0d7903cdfbcf
ldfld System.Int32 <Module>{99875960-efaf-48d2-891d-f5b4a2b293e6}::m_39de36e6da93430bbf0cb916f69cbe56
brtrue IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_008B,IL_0030,IL_00A1,IL_0055,IL_008A)
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙