Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
Very high
1 malicious · 8 files
EXEWinsavesdhcp.exe
Structure
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void MRJLh76n5KrXUyUgl37.oamFTH6wnBlfYwRFqMC::Jgo69KByl2()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void MRJLh76n5KrXUyUgl37.oamFTH6wnBlfYwRFqMC::Jgo69KByl2()
Main IL Instruction Count
53
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C9: newobj System.Void Qp8MsANRDsFhNZN0hEH.CWDFTPNYYdRFk9B6vLc::.ctor()
ldnull <null>
ldnull <null>
newobj System.Void Nj8BGCn3lNqd9npHx9A.tXgYHanr9F1AbFAQ5sL::.ctor(System.String,System.String)
call System.Void egAlsy4ifOLHtm9ppWI.zTtg6k466dbEhHXVBUZ::qDk40vACpf(Nj8BGCn3lNqd9npHx9A.tXgYHanr9F1AbFAQ5sL)
ldc.i4 3
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_344bcb0a2f1540a5ae08e2cfc67f0a79
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
call System.Void dngrcpPEqrGgBawAik5.xPvLCmPlR6GBgDZsCmp::TfE4NslloSK()
ldc.i4 0
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_393c1852ecf54a878078687b56889b6b
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
ldc.i4 1148160798
ldc.i4 1093766528
add <null>
ldc.i4 -628994644
xor <null>
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_1b7d1ed996d840cb839b0d08cd9bc9e4
xor <null>
call System.String u6JkSmBlhJbWSoPcojD.GFIkumB5k53OwABovR4::xcGBI53bM2(System.Int32)
newobj System.Void xdl7uAdmFhkc7kUbMOj.GQVg03dRdyFiTydNgE7::.ctor(System.String)
call System.Void xdl7uAdmFhkc7kUbMOj.GQVg03dRdyFiTydNgE7::iARd2mlUK2()
ldc.i4 4
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_bde49da4198d45428c097350104de150
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
newobj System.Void Qp8MsANRDsFhNZN0hEH.CWDFTPNYYdRFk9B6vLc::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_23303de04bba4e0fbfd65f7ab4e73454
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
ret <null>
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void MRJLh76n5KrXUyUgl37.oamFTH6wnBlfYwRFqMC::Jgo69KByl2()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void MRJLh76n5KrXUyUgl37.oamFTH6wnBlfYwRFqMC::Jgo69KByl2()
Main IL Instruction Count
53
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C9: newobj System.Void Qp8MsANRDsFhNZN0hEH.CWDFTPNYYdRFk9B6vLc::.ctor()
ldnull <null>
ldnull <null>
newobj System.Void Nj8BGCn3lNqd9npHx9A.tXgYHanr9F1AbFAQ5sL::.ctor(System.String,System.String)
call System.Void egAlsy4ifOLHtm9ppWI.zTtg6k466dbEhHXVBUZ::qDk40vACpf(Nj8BGCn3lNqd9npHx9A.tXgYHanr9F1AbFAQ5sL)
ldc.i4 3
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_344bcb0a2f1540a5ae08e2cfc67f0a79
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
call System.Void dngrcpPEqrGgBawAik5.xPvLCmPlR6GBgDZsCmp::TfE4NslloSK()
ldc.i4 0
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_393c1852ecf54a878078687b56889b6b
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
ldc.i4 1148160798
ldc.i4 1093766528
add <null>
ldc.i4 -628994644
xor <null>
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_1b7d1ed996d840cb839b0d08cd9bc9e4
xor <null>
call System.String u6JkSmBlhJbWSoPcojD.GFIkumB5k53OwABovR4::xcGBI53bM2(System.Int32)
newobj System.Void xdl7uAdmFhkc7kUbMOj.GQVg03dRdyFiTydNgE7::.ctor(System.String)
call System.Void xdl7uAdmFhkc7kUbMOj.GQVg03dRdyFiTydNgE7::iARd2mlUK2()
ldc.i4 4
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_bde49da4198d45428c097350104de150
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
newobj System.Void Qp8MsANRDsFhNZN0hEH.CWDFTPNYYdRFk9B6vLc::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44} <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_380df4ffd98f40c88ffdc2dd37161ac9
ldfld System.Int32 <Module>{9c27f3e3-2479-4110-a8ab-7abcfeddbd44}::m_23303de04bba4e0fbfd65f7ab4e73454
brtrue IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00C9,IL_005B,IL_0030,IL_007F,IL_00EE)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙