Deep Malware Analysis of f2c925692a7a9d067464948adaad9dd1 | md5: f2c925692a7a9d067464948adaad9dd1 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.26

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Chtumtecvpu.exe
Full Name	Chtumtecvpu.exe
EntryPoint	System.Void SteamKit2.Modules.GroupedModule::TestModule()
Scope Name	Chtumtecvpu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Chtumtecvpu
Assembly Version	1.0.7274.4224
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void SteamKit2.Modules.GroupedModule::TestModule()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void SteamKit2.Monitoring.OrderedWatcher::.ctor() call System.Byte[] SteamKit2.Monitoring.OrderedWatcher::ObserveResponsiveWatcher() call System.Byte[] Chtumtecvpu.Factories.FactorySolver::CreateSetFactory(System.Object) call System.Void SteamKit2.Helpers.ChooserInspector::DetachChooser(System.Object) ldc.i4 0 ldsfld <Module>{3252589e-f2bc-4504-b836-6c4602ad1db6} <Module>{3252589e-f2bc-4504-b836-6c4602ad1db6}::m_8fc4440d235147c2a1dcd5e20ddc5c8f ldfld System.Int32 <Module>{3252589e-f2bc-4504-b836-6c4602ad1db6}::m_cc63a567429046f48254266f032cd992 brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>