Suspicious
Suspect

f925f96907127bdead9ec8c026f0bf02

PE Executable
MD5: f925f96907127bdead9ec8c026f0bf02
Size: 1 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 f925f96907127bdead9ec8c026f0bf02
Sha1 dc03e82adb937f25b1557d9b3016c76cde31b2df
Sha256 e632a474347f7e231beff070ce83413f9062dfc361fcdab25e0a3fb67a0326fc
Sha384 ffe46c917fad1e55b0b323667537ed2834ada842510c3fa31c9862d83790f82c528a27144b9162b0088e21e7bf517574
Sha512 b6a20260c4d507df2f2aee49a604e07ad0f915f4556bdf38aee74503f931575fc6ef57ad557754485eb5a4d5921b1934aac8b004b0cb1f1e5693a6a5934ff58c
SSDeep 12288:dglJdbjXoJfkotLy+KkIxYtV2/bYHzDyFZzNqWKnUHsRdYVgp3b2BHJWY4LKWTgO:6xoJ8MLyDYH2DYKLgiH20pWGcHK
TLSH F72512A8A607E913C482537D09E1F0B412696FD9D903C217BFDC6DEBBF26F118DA4192
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
f925f96907127bdead9ec8c026f0bf02
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
vBlW.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
WaterCycle.Properties.Resources.resources
Fec
[NBF]root.Data
CzjU
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
vBlW.exe
Full Name
vBlW.exe
EntryPoint
System.Void sw.Hh::MJ()
Scope Name
vBlW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vBlW
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
59
Main Method
System.Void sw.Hh::MJ()
Main IL Instruction Count
137
Main IL 
br IL_0095: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0071: nop
ldloc.s V_2
brtrue IL_00DE: nop
br IL_00A0: newobj System.Void mZ.V5::.ctor()
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
ldc.i4 0
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_151f5a389c6a445c893533d37d4d0aaa
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0071,IL_0052)
ldsfld System.Single[] sw.Hh::jF
ldloc.s V_1
ldloc.s V_3
ldc.i4 350
ldc.i4 480
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
br IL_013F: ldsfld System.Int32[] sw.Hh::au
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.s 50
ldc.i4 550
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01D0: nop
ldc.i4.0 <null>
stloc.s V_1
br IL_0178: br IL_00C1
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_016C: nop
newobj System.Void mZ.V5::.ctor()
stsfld mZ.V5 sw.Hh::QQ
br IL_0182: newobj System.Void tv.pI::.ctor()
nop <null>
ldsfld NbE.dbW sw.Hh::XO
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_01A1: nop
nop <null>
ret <null>
ldloc.s V_1
ldc.i4 500
clt <null>
stloc.s V_2
br IL_001B: ldloc.s V_2
nop <null>
newobj System.Void System.Random::.ctor()
stloc.s V_3
br IL_008D: ldc.i4.0
nop <null>
ldsfld System.Single[] sw.Hh::N4
ldloc.s V_1
ldloc.s V_3
ldc.i4.0 <null>
ldc.i4 300
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldc.i4 1
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_5d2c9614ff95401b9820b063529225ad
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 1
br IL_0009: switch(IL_0071,IL_0052)
newobj System.Void NbE.dbW::.ctor()
stsfld NbE.dbW sw.Hh::XO
br IL_01C1: newobj System.Void Wz.WT::.ctor()
nop <null>
ldsfld tv.pI sw.Hh::Hk
ldc.i4 820
ldc.i4.s 50
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01EC: nop
ldsfld System.Int32[] sw.Hh::au
ldloc.s V_1
ldc.i4.0 <null>
stelem.i4 <null>
br IL_01E0: nop
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4 820
ldc.i4 350
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_0027: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_01FD: call System.Void KbH.rb1::ejg()
br IL_00C1: ldloc.s V_1
br IL_00DE: nop
newobj System.Void tv.pI::.ctor()
stsfld tv.pI sw.Hh::Hk
br IL_0114: newobj System.Void NbE.dbW::.ctor()
nop <null>
ldsfld mZ.V5 sw.Hh::QQ
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00BF: nop
nop <null>
ldsfld Wz.WT sw.Hh::Qo
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_0191: nop
ldsfld tv.pI sw.Hh::Hk
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_0123: nop
newobj System.Void Wz.WT::.ctor()
stsfld Wz.WT sw.Hh::Qo
br IL_01B1: ldsfld tv.pI sw.Hh::Hk
nop <null>
ldsfld tv.pI sw.Hh::Hk
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_00AF: nop
nop <null>
ldloc.s V_1
ldc.i4.1 <null>
add <null>
stloc.s V_1
br IL_00C1: ldloc.s V_1
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_014D: nop
call System.Void KbH.rb1::ejg()
br IL_00D1: nop
Module Name
vBlW.exe
Full Name
vBlW.exe
EntryPoint
System.Void sw.Hh::MJ()
Scope Name
vBlW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vBlW
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
59
Main Method
System.Void sw.Hh::MJ()
Main IL Instruction Count
137
Main IL 
br IL_0095: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0071: nop
ldloc.s V_2
brtrue IL_00DE: nop
br IL_00A0: newobj System.Void mZ.V5::.ctor()
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
ldc.i4 0
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_151f5a389c6a445c893533d37d4d0aaa
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0071,IL_0052)
ldsfld System.Single[] sw.Hh::jF
ldloc.s V_1
ldloc.s V_3
ldc.i4 350
ldc.i4 480
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
br IL_013F: ldsfld System.Int32[] sw.Hh::au
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.s 50
ldc.i4 550
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01D0: nop
ldc.i4.0 <null>
stloc.s V_1
br IL_0178: br IL_00C1
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_016C: nop
newobj System.Void mZ.V5::.ctor()
stsfld mZ.V5 sw.Hh::QQ
br IL_0182: newobj System.Void tv.pI::.ctor()
nop <null>
ldsfld NbE.dbW sw.Hh::XO
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_01A1: nop
nop <null>
ret <null>
ldloc.s V_1
ldc.i4 500
clt <null>
stloc.s V_2
br IL_001B: ldloc.s V_2
nop <null>
newobj System.Void System.Random::.ctor()
stloc.s V_3
br IL_008D: ldc.i4.0
nop <null>
ldsfld System.Single[] sw.Hh::N4
ldloc.s V_1
ldloc.s V_3
ldc.i4.0 <null>
ldc.i4 300
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldc.i4 1
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_5d2c9614ff95401b9820b063529225ad
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 1
br IL_0009: switch(IL_0071,IL_0052)
newobj System.Void NbE.dbW::.ctor()
stsfld NbE.dbW sw.Hh::XO
br IL_01C1: newobj System.Void Wz.WT::.ctor()
nop <null>
ldsfld tv.pI sw.Hh::Hk
ldc.i4 820
ldc.i4.s 50
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01EC: nop
ldsfld System.Int32[] sw.Hh::au
ldloc.s V_1
ldc.i4.0 <null>
stelem.i4 <null>
br IL_01E0: nop
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4 820
ldc.i4 350
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_0027: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_01FD: call System.Void KbH.rb1::ejg()
br IL_00C1: ldloc.s V_1
br IL_00DE: nop
newobj System.Void tv.pI::.ctor()
stsfld tv.pI sw.Hh::Hk
br IL_0114: newobj System.Void NbE.dbW::.ctor()
nop <null>
ldsfld mZ.V5 sw.Hh::QQ
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00BF: nop
nop <null>
ldsfld Wz.WT sw.Hh::Qo
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_0191: nop
ldsfld tv.pI sw.Hh::Hk
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_0123: nop
newobj System.Void Wz.WT::.ctor()
stsfld Wz.WT sw.Hh::Qo
br IL_01B1: ldsfld tv.pI sw.Hh::Hk
nop <null>
ldsfld tv.pI sw.Hh::Hk
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_00AF: nop
nop <null>
ldloc.s V_1
ldc.i4.1 <null>
add <null>
stloc.s V_1
br IL_00C1: ldloc.s V_1
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_014D: nop
call System.Void KbH.rb1::ejg()
br IL_00D1: nop
f925f96907127bdead9ec8c026f0bf02
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
vBlW.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
WaterCycle.Properties.Resources.resources
Fec
[NBF]root.Data
CzjU
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙