Malicious PE Executable analysis – f8a7ac6e2913

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Very high

1 malicious · 6 files

EXEf8a7ac6e2913829b41dae53329e2cb22

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	tmpBREDX85634012013updater.exe
Full Name	tmpBREDX85634012013updater.exe
EntryPoint	System.Void qQOK3ymsHj3h2oAWdH.NLTuVSpF5vVxYiDegC::XsVfdMCkh()
Scope Name	tmpBREDX85634012013updater.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tmpBREDX85634012013updater
Assembly Version	6.1459.2.26
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	39
Main Method	System.Void qQOK3ymsHj3h2oAWdH.NLTuVSpF5vVxYiDegC::XsVfdMCkh()
Main IL Instruction Count	42
Main IL	ldc.i4 4 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_009B: ret call System.Void CHd5sH8pulGbO7wFcet.GjDNOx85Q6r04v7VFj9::PFYoRgVl4d() ldc.i4 2 br IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) newobj System.Void Jfgsg0vXadgzh7e.Ldg5gVbwsF::.ctor() ldsfld xJUDZPqZDu9U2E1AFth xJUDZPqZDu9U2E1AFth::m40qGWtcZX call System.Void xJUDZPqZDu9U2E1AFth::lF9OShbUVu(System.Windows.Forms.Form,xJUDZPqZDu9U2E1AFth) ldc.i4 0 ldsfld <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987} <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_d325807770314644936d0fc393491c03 ldfld System.Int32 <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_660d12246dba44619efd2f457e547042 brfalse IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) pop <null> ldc.i4 0 br IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) ldc.i4.0 <null> ldsfld Xg2oN4qxu1vjRBhDtWi Xg2oN4qxu1vjRBhDtWi::qXMqNPRkOZ call System.Void Xg2oN4qxu1vjRBhDtWi::lF9OShbUVu(System.Boolean,Xg2oN4qxu1vjRBhDtWi) ldc.i4 1 ldsfld <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987} <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_d325807770314644936d0fc393491c03 ldfld System.Int32 <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_48f23a9145824325a9140e594a57fa54 brfalse IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) pop <null> ldc.i4 1 br IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) ret <null> ldsfld lH08Lbq0MvuUJQeuNn3 lH08Lbq0MvuUJQeuNn3::guFqHTpUMs call System.Void lH08Lbq0MvuUJQeuNn3::lF9OShbUVu(lH08Lbq0MvuUJQeuNn3) ldc.i4 5 br IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) call System.Void vahxEf8StSiYyWw1f3m.MEItNZ8I2SYHC3SYXRu::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 3 ldsfld <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987} <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_d325807770314644936d0fc393491c03 ldfld System.Int32 <Module>{fb051d02-53f4-47e5-a44e-a48ab5d39987}::m_e739c58494fb4bcaa76225e78355e646 brtrue IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071) pop <null> ldc.i4 2 br IL_0012: switch(IL_009B,IL_0034,IL_0043,IL_009C,IL_00B0,IL_0071)