Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXEef550978657954819eb7364490741b75
Structure
Name Value
Module Name
Movasek.exe
Full Name
Movasek.exe
EntryPoint
System.Void QPTyId6Cu7l9Fvgs5l.uqQvRkBRyHkhg3FYCf::z8cSwZTiw()
Scope Name
Movasek.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Movasek
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void QPTyId6Cu7l9Fvgs5l.uqQvRkBRyHkhg3FYCf::z8cSwZTiw()
Main IL Instruction Count
112
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void GaUmJbVkZfxGtHgarf.zIkpyAfDbIQAtLA6of::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_23d81ff98e1c4347a81c149f78ed770d
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 0
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
br IL_0063: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 11
beq IL_009D: newobj System.Void TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE::.ctor()
ldloc V_0
ldc.i4 991
beq IL_0063: ldloc V_0
br IL_00D4: newobj System.Void XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY::.ctor()
newobj System.Void TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE::.ctor()
stloc.s V_4
ldc.i4 1
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_dadaa40a207c4724af58508672d01922
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 1
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void rNVVstguitVBTqH8JK.bNvsKeqiS94Hio84se::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY::.ctor()
dup <null>
dup <null>
ldsfld mtiuyIQ1wZw7IhSAHi3 mtiuyIQ1wZw7IhSAHi3::vm9QHlRBK4
call System.Void mtiuyIQ1wZw7IhSAHi3::y5OQSAvrsX(System.Object,XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY,mtiuyIQ1wZw7IhSAHi3)
dup <null>
ldloc.s V_6
ldsfld LpHJ7jQE5qP4teqqG73 LpHJ7jQE5qP4teqqG73::GLmQ4L4oqT
call System.Void LpHJ7jQE5qP4teqqG73::y5OQSAvrsX(System.Object,rNVVstguitVBTqH8JK.bNvsKeqiS94Hio84se,LpHJ7jQE5qP4teqqG73)
ldloc.s V_6
ldloc.s V_4
ldsfld mXMOFBQuT3FKJbkYeHu mXMOFBQuT3FKJbkYeHu::H1mQRNMgeG
call System.Void mXMOFBQuT3FKJbkYeHu::y5OQSAvrsX(System.Object,TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE,mXMOFBQuT3FKJbkYeHu)
ldloc.s V_4
ldloc.s V_1
ldsfld XjTrWuQaQJ0ON6PparH XjTrWuQaQJ0ON6PparH::T06Q59KqaO
call System.Void XjTrWuQaQJ0ON6PparH::y5OQSAvrsX(System.Object,f3giM85vMltXb2KMUA.LjbjwOa53RDKJuBYxw,XjTrWuQaQJ0ON6PparH)
ldloc.s V_1
ldloc.s V_5
ldsfld PboYlbQGDZdXZrUnbYC PboYlbQGDZdXZrUnbYC::BkTQltd0x8
call System.Void PboYlbQGDZdXZrUnbYC::y5OQSAvrsX(System.Object,GaUmJbVkZfxGtHgarf.zIkpyAfDbIQAtLA6of,PboYlbQGDZdXZrUnbYC)
ldsfld KEXnQLQ8I4vKtnoHouj KEXnQLQ8I4vKtnoHouj::IBEQUycSL6
call System.Boolean KEXnQLQ8I4vKtnoHouj::y5OQSAvrsX(System.Object,KEXnQLQ8I4vKtnoHouj)
brtrue IL_0176: leave IL_002D
ldc.i4 0
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_c5b29a41f72b4423912991d388c70899
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 7
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void f3giM85vMltXb2KMUA.LjbjwOa53RDKJuBYxw::.ctor()
stloc.s V_1
ldc.i4 10
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_f958c5b605b6494a8d4dee26b58fc903
brfalse IL_005F: stloc V_0
pop <null>
ldc.i4 11
br IL_005F: stloc V_0
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 1
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_b34b36ce4d304b1eb08495f024b58dda
brtrue IL_01AD: switch(IL_01C9)
pop <null>
ldc.i4 0
br IL_01AD: switch(IL_01C9)
br IL_01A9: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01A9: ldloc V_2
br IL_01C9: leave IL_002D
leave IL_002D: ret
ldc.i4 3
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_9fc16a51694b405d9c8123a6981d9834
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
Module Name
Movasek.exe
Full Name
Movasek.exe
EntryPoint
System.Void QPTyId6Cu7l9Fvgs5l.uqQvRkBRyHkhg3FYCf::z8cSwZTiw()
Scope Name
Movasek.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Movasek
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void QPTyId6Cu7l9Fvgs5l.uqQvRkBRyHkhg3FYCf::z8cSwZTiw()
Main IL Instruction Count
112
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void GaUmJbVkZfxGtHgarf.zIkpyAfDbIQAtLA6of::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_23d81ff98e1c4347a81c149f78ed770d
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 0
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
br IL_0063: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 11
beq IL_009D: newobj System.Void TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE::.ctor()
ldloc V_0
ldc.i4 991
beq IL_0063: ldloc V_0
br IL_00D4: newobj System.Void XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY::.ctor()
newobj System.Void TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE::.ctor()
stloc.s V_4
ldc.i4 1
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_dadaa40a207c4724af58508672d01922
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 1
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void rNVVstguitVBTqH8JK.bNvsKeqiS94Hio84se::.ctor()
stloc.s V_6
ldc.i4 3
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY::.ctor()
dup <null>
dup <null>
ldsfld mtiuyIQ1wZw7IhSAHi3 mtiuyIQ1wZw7IhSAHi3::vm9QHlRBK4
call System.Void mtiuyIQ1wZw7IhSAHi3::y5OQSAvrsX(System.Object,XqVOM7CDWTAZkuTYwm.KlEnaD2EaiqGjbAIeY,mtiuyIQ1wZw7IhSAHi3)
dup <null>
ldloc.s V_6
ldsfld LpHJ7jQE5qP4teqqG73 LpHJ7jQE5qP4teqqG73::GLmQ4L4oqT
call System.Void LpHJ7jQE5qP4teqqG73::y5OQSAvrsX(System.Object,rNVVstguitVBTqH8JK.bNvsKeqiS94Hio84se,LpHJ7jQE5qP4teqqG73)
ldloc.s V_6
ldloc.s V_4
ldsfld mXMOFBQuT3FKJbkYeHu mXMOFBQuT3FKJbkYeHu::H1mQRNMgeG
call System.Void mXMOFBQuT3FKJbkYeHu::y5OQSAvrsX(System.Object,TocRg6KD0SgymM83wT.px7KlbjFfWlZNgH6sE,mXMOFBQuT3FKJbkYeHu)
ldloc.s V_4
ldloc.s V_1
ldsfld XjTrWuQaQJ0ON6PparH XjTrWuQaQJ0ON6PparH::T06Q59KqaO
call System.Void XjTrWuQaQJ0ON6PparH::y5OQSAvrsX(System.Object,f3giM85vMltXb2KMUA.LjbjwOa53RDKJuBYxw,XjTrWuQaQJ0ON6PparH)
ldloc.s V_1
ldloc.s V_5
ldsfld PboYlbQGDZdXZrUnbYC PboYlbQGDZdXZrUnbYC::BkTQltd0x8
call System.Void PboYlbQGDZdXZrUnbYC::y5OQSAvrsX(System.Object,GaUmJbVkZfxGtHgarf.zIkpyAfDbIQAtLA6of,PboYlbQGDZdXZrUnbYC)
ldsfld KEXnQLQ8I4vKtnoHouj KEXnQLQ8I4vKtnoHouj::IBEQUycSL6
call System.Boolean KEXnQLQ8I4vKtnoHouj::y5OQSAvrsX(System.Object,KEXnQLQ8I4vKtnoHouj)
brtrue IL_0176: leave IL_002D
ldc.i4 0
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_c5b29a41f72b4423912991d388c70899
brtrue IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
pop <null>
ldc.i4 7
br IL_0067: switch(IL_0170,IL_00C3,IL_014A,IL_00D4)
newobj System.Void f3giM85vMltXb2KMUA.LjbjwOa53RDKJuBYxw::.ctor()
stloc.s V_1
ldc.i4 10
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_f958c5b605b6494a8d4dee26b58fc903
brfalse IL_005F: stloc V_0
pop <null>
ldc.i4 11
br IL_005F: stloc V_0
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 1
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_b34b36ce4d304b1eb08495f024b58dda
brtrue IL_01AD: switch(IL_01C9)
pop <null>
ldc.i4 0
br IL_01AD: switch(IL_01C9)
br IL_01A9: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_01A9: ldloc V_2
br IL_01C9: leave IL_002D
leave IL_002D: ret
ldc.i4 3
ldsfld <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a} <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_915aeeec84254b73be6901e6b0c85ed9
ldfld System.Int32 <Module>{2eacf641-e201-4ff7-a0fa-148c89c5bb9a}::m_9fc16a51694b405d9c8123a6981d9834
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙