Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
FileType
Portable Executable file
DetectionPeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEf5dff9fcff114fe2159177ebac4f93d3PE32 x86XWorm
Structure
| Name |
Value |
| Module Name |
|
| Full Name |
|
| EntryPoint |
System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::R064mmJdGJm6pyJ3vEjWZjfJEkT1L2smtlOJ7OUy7jLDSar7bKE9yFTb4fNd811l9TXSmZADG6NcnN5XppuAvB9LAM9g7PGrjtY()
|
| Scope Name |
|
| Scope Type |
|
| Kind |
|
| Runtime Version |
|
| Tables Header Version |
|
| WinMD Version |
|
| Assembly Name |
|
| Assembly Version |
|
| Assembly Culture |
|
| Has PublicKey |
|
| PublicKey Token |
|
| Target Framework |
|
| Total Strings |
|
| Main Method |
System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::R064mmJdGJm6pyJ3vEjWZjfJEkT1L2smtlOJ7OUy7jLDSar7bKE9yFTb4fNd811l9TXSmZADG6NcnN5XppuAvB9LAM9g7PGrjtY()
|
| Main IL Instruction Count |
|
| Main IL |
ldsfld System.Int32 OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::PZ0dTEsbndg6WeFzwGweTTF30vbXJA1CYF1cQHobI76Q1vHPFI71OpxcuO6PeASAY04lt4mnayVeniXuCcGWqNL7DkzvsLsSPLU
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::Y3RcUt2zm3LzQJoUMIwp1NWyAMQra15E0i4WYh2ukCenRo6dwTFeuGjpZ6SiJTIsQ32iQyxbixhUBg61Chr0ajr5ZDoecBsJ9mv
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::Y3RcUt2zm3LzQJoUMIwp1NWyAMQra15E0i4WYh2ukCenRo6dwTFeuGjpZ6SiJTIsQ32iQyxbixhUBg61Chr0ajr5ZDoecBsJ9mv
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::fQaGFAXl6u0QcLLoaVKfdoLn5zqnuywCExJTaycwPRDZSo5AtTbDwlAMuU6uF0dpO7p1M7KoddlD6xVSHLjGwGCNwNytr9QLsrL
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::fQaGFAXl6u0QcLLoaVKfdoLn5zqnuywCExJTaycwPRDZSo5AtTbDwlAMuU6uF0dpO7p1M7KoddlD6xVSHLjGwGCNwNytr9QLsrL
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::YnPhLVTyz9Dtupf9wJsJg65QHVxuKSXp5FDg5ADfsmzfz1L38fsQZpVqlIm7WveVUnfBuTxdbzSskypJgmWaQz4CJgPjLWfZH4X
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::YnPhLVTyz9Dtupf9wJsJg65QHVxuKSXp5FDg5ADfsmzfz1L38fsQZpVqlIm7WveVUnfBuTxdbzSskypJgmWaQz4CJgPjLWfZH4X
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::9quCNMtGvYlEzO5yUaXzKOp8dOXXSvuJYlpa0qxe7bKGwnqsqHttd8fpugEbEDptrGtfqRkIj0DvL87asuaZZ8xQbzvFg5VVIuT
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::9quCNMtGvYlEzO5yUaXzKOp8dOXXSvuJYlpa0qxe7bKGwnqsqHttd8fpugEbEDptrGtfqRkIj0DvL87asuaZZ8xQbzvFg5VVIuT
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::O1Vyj0eRzy9FKGStZG2dZn2N0z2HzwO6LtZLbZPrwXh8M97z5oVrqkii9DaRXDW3fZdprTGtuRi3QcTLp7chhepIvma7WCHlLbE
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::O1Vyj0eRzy9FKGStZG2dZn2N0z2HzwO6LtZLbZPrwXh8M97z5oVrqkii9DaRXDW3fZdprTGtuRi3QcTLp7chhepIvma7WCHlLbE
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::SvrD13GAx7zXXWTu7UXQCVWjMHYzwWJwhROmyfKFTQ9axaJvKT0bvOnxv4huKvqp7hSTbpfcNSIUt0ole25pIxkMKwSW8OggSjG
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::SvrD13GAx7zXXWTu7UXQCVWjMHYzwWJwhROmyfKFTQ9axaJvKT0bvOnxv4huKvqp7hSTbpfcNSIUt0ole25pIxkMKwSW8OggSjG
leave.s IL_009E: call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
brtrue.s IL_00AB: call System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::03MnHVHRCU9wY93Z5gt9amHCkebWsgQwgkb6lo5fBqgRiVv8z2mjx6wxAXT3I6JW3FAjh72kMXaJIwa3Og2QYVOagari0Un2s8u()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::03MnHVHRCU9wY93Z5gt9amHCkebWsgQwgkb6lo5fBqgRiVv8z2mjx6wxAXT3I6JW3FAjh72kMXaJIwa3Og2QYVOagari0Un2s8u()
call System.Void Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::2ibavHMHcSjhf1BDqiXHSeum1y()
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::mazVZGYuURd3TF2XQ6R8zny5pw0zMCjZNGN2khNQPIR1NLJ6y6zHbuTa6FXhaceKYmgxjPaBPuDW4GCHWzyFlT2g4Gsb1YY30m7()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.7JLIaDrafGt4YuASKo2Uju8DT6pMB3kQwg8zgYGcfUysr2Q62KT2LodRRhHPL3xsHWDQwrxkoUsVGZ2iTNWV7p3onrXnzFREehF::ETLhqjFGKFHhnCTDxZVxbkJBMrY7nwI4wcSZIip4gPotirjHvfnocRphhKwyJQTutpmbKoSmyc0OPHDMV4bDoK6ZL6naO68gJSg()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_00DC: ldnull
call System.Void Stub.vSdHClomDY1jw1vxtfxjVgbanm::U4OhpfKAGHWYlKc7oEbJe8spZm()
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::eKKttIAzgSawgKMqgVS4RLJBWDzT1h0nPWc29cDavbiW3YyvfBZU4RUel95lBB4dEDheXMclX7IPHl7MXCzRcTqOSciYuCYnF6n()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::B7uym6xqZaSsBFBDj5J4yudj5imAUGdfIdZrXpIxHhngmK74jHVp2BgMAd6OJlILlyCxKCogimfTzqU5pHWVyVWFri8Co49BKvf()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
|
| Module Name |
|
| Full Name |
|
| EntryPoint |
System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::R064mmJdGJm6pyJ3vEjWZjfJEkT1L2smtlOJ7OUy7jLDSar7bKE9yFTb4fNd811l9TXSmZADG6NcnN5XppuAvB9LAM9g7PGrjtY()
|
| Scope Name |
|
| Scope Type |
|
| Kind |
|
| Runtime Version |
|
| Tables Header Version |
|
| WinMD Version |
|
| Assembly Name |
|
| Assembly Version |
|
| Assembly Culture |
|
| Has PublicKey |
|
| PublicKey Token |
|
| Target Framework |
|
| Total Strings |
|
| Main Method |
System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::R064mmJdGJm6pyJ3vEjWZjfJEkT1L2smtlOJ7OUy7jLDSar7bKE9yFTb4fNd811l9TXSmZADG6NcnN5XppuAvB9LAM9g7PGrjtY()
|
| Main IL Instruction Count |
|
| Main IL |
ldsfld System.Int32 OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::PZ0dTEsbndg6WeFzwGweTTF30vbXJA1CYF1cQHobI76Q1vHPFI71OpxcuO6PeASAY04lt4mnayVeniXuCcGWqNL7DkzvsLsSPLU
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::Y3RcUt2zm3LzQJoUMIwp1NWyAMQra15E0i4WYh2ukCenRo6dwTFeuGjpZ6SiJTIsQ32iQyxbixhUBg61Chr0ajr5ZDoecBsJ9mv
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::Y3RcUt2zm3LzQJoUMIwp1NWyAMQra15E0i4WYh2ukCenRo6dwTFeuGjpZ6SiJTIsQ32iQyxbixhUBg61Chr0ajr5ZDoecBsJ9mv
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::fQaGFAXl6u0QcLLoaVKfdoLn5zqnuywCExJTaycwPRDZSo5AtTbDwlAMuU6uF0dpO7p1M7KoddlD6xVSHLjGwGCNwNytr9QLsrL
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::fQaGFAXl6u0QcLLoaVKfdoLn5zqnuywCExJTaycwPRDZSo5AtTbDwlAMuU6uF0dpO7p1M7KoddlD6xVSHLjGwGCNwNytr9QLsrL
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::YnPhLVTyz9Dtupf9wJsJg65QHVxuKSXp5FDg5ADfsmzfz1L38fsQZpVqlIm7WveVUnfBuTxdbzSskypJgmWaQz4CJgPjLWfZH4X
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::YnPhLVTyz9Dtupf9wJsJg65QHVxuKSXp5FDg5ADfsmzfz1L38fsQZpVqlIm7WveVUnfBuTxdbzSskypJgmWaQz4CJgPjLWfZH4X
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::9quCNMtGvYlEzO5yUaXzKOp8dOXXSvuJYlpa0qxe7bKGwnqsqHttd8fpugEbEDptrGtfqRkIj0DvL87asuaZZ8xQbzvFg5VVIuT
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::9quCNMtGvYlEzO5yUaXzKOp8dOXXSvuJYlpa0qxe7bKGwnqsqHttd8fpugEbEDptrGtfqRkIj0DvL87asuaZZ8xQbzvFg5VVIuT
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::O1Vyj0eRzy9FKGStZG2dZn2N0z2HzwO6LtZLbZPrwXh8M97z5oVrqkii9DaRXDW3fZdprTGtuRi3QcTLp7chhepIvma7WCHlLbE
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::O1Vyj0eRzy9FKGStZG2dZn2N0z2HzwO6LtZLbZPrwXh8M97z5oVrqkii9DaRXDW3fZdprTGtuRi3QcTLp7chhepIvma7WCHlLbE
ldsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::SvrD13GAx7zXXWTu7UXQCVWjMHYzwWJwhROmyfKFTQ9axaJvKT0bvOnxv4huKvqp7hSTbpfcNSIUt0ole25pIxkMKwSW8OggSjG
call System.Object Stub.Sxe0wpqgDgEkHX6mO2myOyftcN::hFaOh5Us03efMIZbSHLusqU7sz(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String OrxgIkBlzef5GEN7ywAkS5puTSnJDIYXlzxEE98e4SrdVAE4jRFtbOmO6i0Zqex1KBmPjjD2B3JHCZkSZ7Wb8FCY4JiesVePO37::SvrD13GAx7zXXWTu7UXQCVWjMHYzwWJwhROmyfKFTQ9axaJvKT0bvOnxv4huKvqp7hSTbpfcNSIUt0ole25pIxkMKwSW8OggSjG
leave.s IL_009E: call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
call System.Boolean Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::bWW8NJroRqzA1ZmvYU4Ft75Wpd()
brtrue.s IL_00AB: call System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::03MnHVHRCU9wY93Z5gt9amHCkebWsgQwgkb6lo5fBqgRiVv8z2mjx6wxAXT3I6JW3FAjh72kMXaJIwa3Og2QYVOagari0Un2s8u()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::03MnHVHRCU9wY93Z5gt9amHCkebWsgQwgkb6lo5fBqgRiVv8z2mjx6wxAXT3I6JW3FAjh72kMXaJIwa3Og2QYVOagari0Un2s8u()
call System.Void Stub.Nj0dPDV6cWKHgA8vB39P7YP4Io::2ibavHMHcSjhf1BDqiXHSeum1y()
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::mazVZGYuURd3TF2XQ6R8zny5pw0zMCjZNGN2khNQPIR1NLJ6y6zHbuTa6FXhaceKYmgxjPaBPuDW4GCHWzyFlT2g4Gsb1YY30m7()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.7JLIaDrafGt4YuASKo2Uju8DT6pMB3kQwg8zgYGcfUysr2Q62KT2LodRRhHPL3xsHWDQwrxkoUsVGZ2iTNWV7p3onrXnzFREehF::ETLhqjFGKFHhnCTDxZVxbkJBMrY7nwI4wcSZIip4gPotirjHvfnocRphhKwyJQTutpmbKoSmyc0OPHDMV4bDoK6ZL6naO68gJSg()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_00DC: ldnull
call System.Void Stub.vSdHClomDY1jw1vxtfxjVgbanm::U4OhpfKAGHWYlKc7oEbJe8spZm()
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::eKKttIAzgSawgKMqgVS4RLJBWDzT1h0nPWc29cDavbiW3YyvfBZU4RUel95lBB4dEDheXMclX7IPHl7MXCzRcTqOSciYuCYnF6n()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.3Pv5P3HUQdUuKYcIQpuHjJBA3fIpFoK1qHBhnrn9QE57XcT67F5hqYuuGaG9FOmbONdii7Im9mruGnALHHZqye1sqh1dJh5VaIT::B7uym6xqZaSsBFBDj5J4yudj5imAUGdfIdZrXpIxHhngmK74jHVp2BgMAd6OJlILlyCxKCogimfTzqU5pHWVyVWFri8Co49BKvf()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
|
1 malicious · 3 files
EXEf5dff9fcff114fe2159177ebac4f93d3PE32 x86XWorm
Structure
No malware configuration was found at this point.
Coming soon: export of this report's indicators to MISP and EDR platforms.