Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: f4c4efd3636904ac0d25722f893166dd
Size: 568.83 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f4c4efd3636904ac0d25722f893166dd
Sha1 87a49a0223e34dbbe70e2311ea3a4148d072ed6f
Sha256 2ead3b4303a43796d7de2cf5fbd28743b3e1cf9690626ae575d360c474fb0639
Sha384 391f5c13268dbe2aa67b1f11efa65aacd551396da1612e65a333db8695bf49e241e654aef9e1cee9fa2948c94c63bcfa
Sha512 fe41d23aabd0a6661e3f711f6a1128fada6195181df6da2588506d6e2c9163da47aa104f90159244e8cefe433d7bd43cf00248417165ebf149565ebf5cc94125
SSDeep 12288:dPw4Bw1hbJVOCJz03VJcuEzd5z1EEfPN3bRgeeTacV07zMtpm:dPw4BkSozgVyuUB9fl3bqeeT56zM
TLSH 52C4028A7B84A702C6606EB6C0E3857503F69ACB7273D7453E1153D6BE013E6CE49BC8
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f4c4efd3636904ac0d25722f893166dd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
gDRR3XbkGTXWk9KTxs.fQBte6Vpvqv9fwcVSj
l0JFPZoqcDlTxCknRC.gctXDIwvSNS8eKimVL
9s6OG9tcW6FH2tH9hG.itwGwBeVxgUqUU7VTM
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Aobujcwld.exe
Full Name
Aobujcwld.exe
EntryPoint
System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA::hrgrk60Ah()
Scope Name
Aobujcwld.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aobujcwld
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA::hrgrk60Ah()
Main IL Instruction Count
84
Main IL 
ldc.i4 3
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_014F: ldsfld s6sCelbW4FxSyZkjGoR s6sCelbW4FxSyZkjGoR::p85bukYQRn
nop <null>
ldsfld System.Threading.ThreadStart qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::cadAuG5Gs
dup <null>
brtrue IL_00A9: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_76e40b9f002b4068bc1aabe3d4aad76c
brtrue IL_0073: switch(IL_0093,IL_00D7)
pop <null>
ldc.i4 5
br IL_0073: switch(IL_0093,IL_00D7)
br IL_006F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_006F: ldloc V_1
br IL_0093: ldsfld qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::qiARPvfLl
ldsfld qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::qiARPvfLl
ldftn System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::S9oB2X9MM()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::cadAuG5Gs
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld Iv2wHgb2fC221BEReGk Iv2wHgb2fC221BEReGk::fR0bLIY2Jk
call System.Void Iv2wHgb2fC221BEReGk::biqbAFYbom(System.Object,Iv2wHgb2fC221BEReGk)
ldc.i4 1
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_d9f0eaf27788428092843f77d7a841bb
brtrue IL_0073: switch(IL_0093,IL_00D7)
pop <null>
ldc.i4 1
br IL_0073: switch(IL_0093,IL_00D7)
leave IL_0163: ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
pop <null>
ldc.i4 4
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_336ca702c9bc498998382960e9452c74
brtrue IL_010E: switch(IL_012A)
pop <null>
ldc.i4 0
br IL_010E: switch(IL_012A)
br IL_010A: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_010A: ldloc V_2
br IL_012A: leave IL_0163
leave IL_0163: ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
ldc.i4 0
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_ce275910bf0843d0a6c1583610f13389
brtrue IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
ret <null>
ldsfld s6sCelbW4FxSyZkjGoR s6sCelbW4FxSyZkjGoR::p85bukYQRn
call System.Void s6sCelbW4FxSyZkjGoR::biqbAFYbom(s6sCelbW4FxSyZkjGoR)
ldc.i4 2
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
call System.Void Kjaa0Tb8LJiEuBmWD1v::biqbAFYbom(Kjaa0Tb8LJiEuBmWD1v)
ldc.i4 2
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_59002d16a00346f088e85d5e86fbbc79
brfalse IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
Module Name
Aobujcwld.exe
Full Name
Aobujcwld.exe
EntryPoint
System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA::hrgrk60Ah()
Scope Name
Aobujcwld.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aobujcwld
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA::hrgrk60Ah()
Main IL Instruction Count
84
Main IL 
ldc.i4 3
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_014F: ldsfld s6sCelbW4FxSyZkjGoR s6sCelbW4FxSyZkjGoR::p85bukYQRn
nop <null>
ldsfld System.Threading.ThreadStart qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::cadAuG5Gs
dup <null>
brtrue IL_00A9: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_76e40b9f002b4068bc1aabe3d4aad76c
brtrue IL_0073: switch(IL_0093,IL_00D7)
pop <null>
ldc.i4 5
br IL_0073: switch(IL_0093,IL_00D7)
br IL_006F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_006F: ldloc V_1
br IL_0093: ldsfld qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::qiARPvfLl
ldsfld qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::qiARPvfLl
ldftn System.Void qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::S9oB2X9MM()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart qSdLdPm9Xueoo8uwdJ.y8vX9C9XwEho1xXLoA/<>c::cadAuG5Gs
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld Iv2wHgb2fC221BEReGk Iv2wHgb2fC221BEReGk::fR0bLIY2Jk
call System.Void Iv2wHgb2fC221BEReGk::biqbAFYbom(System.Object,Iv2wHgb2fC221BEReGk)
ldc.i4 1
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_d9f0eaf27788428092843f77d7a841bb
brtrue IL_0073: switch(IL_0093,IL_00D7)
pop <null>
ldc.i4 1
br IL_0073: switch(IL_0093,IL_00D7)
leave IL_0163: ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
pop <null>
ldc.i4 4
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_336ca702c9bc498998382960e9452c74
brtrue IL_010E: switch(IL_012A)
pop <null>
ldc.i4 0
br IL_010E: switch(IL_012A)
br IL_010A: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_010A: ldloc V_2
br IL_012A: leave IL_0163
leave IL_0163: ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
ldc.i4 0
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_ce275910bf0843d0a6c1583610f13389
brtrue IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
ret <null>
ldsfld s6sCelbW4FxSyZkjGoR s6sCelbW4FxSyZkjGoR::p85bukYQRn
call System.Void s6sCelbW4FxSyZkjGoR::biqbAFYbom(s6sCelbW4FxSyZkjGoR)
ldc.i4 2
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
ldsfld Kjaa0Tb8LJiEuBmWD1v Kjaa0Tb8LJiEuBmWD1v::yIebMoqX9P
call System.Void Kjaa0Tb8LJiEuBmWD1v::biqbAFYbom(Kjaa0Tb8LJiEuBmWD1v)
ldc.i4 2
ldsfld <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b} <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_8742bc5e0c6f4971a4c94b2cae09db71
ldfld System.Int32 <Module>{f99d9d11-ab41-4516-97a8-3b5624953b9b}::m_59002d16a00346f088e85d5e86fbbc79
brfalse IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0163,IL_014E,IL_0035,IL_014F)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙