Suspicious
Suspect

f925f96907127bdead9ec8c026f0bf02

Share on LinkedIn
Print
PE Executable
MD5: f925f96907127bdead9ec8c026f0bf02
Size: 1 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 f925f96907127bdead9ec8c026f0bf02
Sha1 dc03e82adb937f25b1557d9b3016c76cde31b2df
Sha256 e632a474347f7e231beff070ce83413f9062dfc361fcdab25e0a3fb67a0326fc
Sha384 ffe46c917fad1e55b0b323667537ed2834ada842510c3fa31c9862d83790f82c528a27144b9162b0088e21e7bf517574
Sha512 b6a20260c4d507df2f2aee49a604e07ad0f915f4556bdf38aee74503f931575fc6ef57ad557754485eb5a4d5921b1934aac8b004b0cb1f1e5693a6a5934ff58c
SSDeep 12288:dglJdbjXoJfkotLy+KkIxYtV2/bYHzDyFZzNqWKnUHsRdYVgp3b2BHJWY4LKWTgO:6xoJ8MLyDYH2DYKLgiH20pWGcHK
TLSH F72512A8A607E913C482537D09E1F0B412696FD9D903C217BFDC6DEBBF26F118DA4192
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
f925f96907127bdead9ec8c026f0bf02
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
vBlW.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
WaterCycle.Properties.Resources.resources
Fec
[NBF]root.Data
CzjU
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
vBlW.exe
Full Name
vBlW.exe
EntryPoint
System.Void sw.Hh::MJ()
Scope Name
vBlW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vBlW
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
59
Main Method
System.Void sw.Hh::MJ()
Main IL Instruction Count
137
Main IL 
br IL_0095: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0071: nop
ldloc.s V_2
brtrue IL_00DE: nop
br IL_00A0: newobj System.Void mZ.V5::.ctor()
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
ldc.i4 0
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_151f5a389c6a445c893533d37d4d0aaa
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0071,IL_0052)
ldsfld System.Single[] sw.Hh::jF
ldloc.s V_1
ldloc.s V_3
ldc.i4 350
ldc.i4 480
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
br IL_013F: ldsfld System.Int32[] sw.Hh::au
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.s 50
ldc.i4 550
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01D0: nop
ldc.i4.0 <null>
stloc.s V_1
br IL_0178: br IL_00C1
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_016C: nop
newobj System.Void mZ.V5::.ctor()
stsfld mZ.V5 sw.Hh::QQ
br IL_0182: newobj System.Void tv.pI::.ctor()
nop <null>
ldsfld NbE.dbW sw.Hh::XO
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_01A1: nop
nop <null>
ret <null>
ldloc.s V_1
ldc.i4 500
clt <null>
stloc.s V_2
br IL_001B: ldloc.s V_2
nop <null>
newobj System.Void System.Random::.ctor()
stloc.s V_3
br IL_008D: ldc.i4.0
nop <null>
ldsfld System.Single[] sw.Hh::N4
ldloc.s V_1
ldloc.s V_3
ldc.i4.0 <null>
ldc.i4 300
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldc.i4 1
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_5d2c9614ff95401b9820b063529225ad
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 1
br IL_0009: switch(IL_0071,IL_0052)
newobj System.Void NbE.dbW::.ctor()
stsfld NbE.dbW sw.Hh::XO
br IL_01C1: newobj System.Void Wz.WT::.ctor()
nop <null>
ldsfld tv.pI sw.Hh::Hk
ldc.i4 820
ldc.i4.s 50
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01EC: nop
ldsfld System.Int32[] sw.Hh::au
ldloc.s V_1
ldc.i4.0 <null>
stelem.i4 <null>
br IL_01E0: nop
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4 820
ldc.i4 350
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_0027: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_01FD: call System.Void KbH.rb1::ejg()
br IL_00C1: ldloc.s V_1
br IL_00DE: nop
newobj System.Void tv.pI::.ctor()
stsfld tv.pI sw.Hh::Hk
br IL_0114: newobj System.Void NbE.dbW::.ctor()
nop <null>
ldsfld mZ.V5 sw.Hh::QQ
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00BF: nop
nop <null>
ldsfld Wz.WT sw.Hh::Qo
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_0191: nop
ldsfld tv.pI sw.Hh::Hk
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_0123: nop
newobj System.Void Wz.WT::.ctor()
stsfld Wz.WT sw.Hh::Qo
br IL_01B1: ldsfld tv.pI sw.Hh::Hk
nop <null>
ldsfld tv.pI sw.Hh::Hk
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_00AF: nop
nop <null>
ldloc.s V_1
ldc.i4.1 <null>
add <null>
stloc.s V_1
br IL_00C1: ldloc.s V_1
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_014D: nop
call System.Void KbH.rb1::ejg()
br IL_00D1: nop
Module Name
vBlW.exe
Full Name
vBlW.exe
EntryPoint
System.Void sw.Hh::MJ()
Scope Name
vBlW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vBlW
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
59
Main Method
System.Void sw.Hh::MJ()
Main IL Instruction Count
137
Main IL 
br IL_0095: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0071: nop
ldloc.s V_2
brtrue IL_00DE: nop
br IL_00A0: newobj System.Void mZ.V5::.ctor()
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
ldc.i4 0
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_151f5a389c6a445c893533d37d4d0aaa
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0071,IL_0052)
ldsfld System.Single[] sw.Hh::jF
ldloc.s V_1
ldloc.s V_3
ldc.i4 350
ldc.i4 480
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
br IL_013F: ldsfld System.Int32[] sw.Hh::au
nop <null>
ldsfld Wz.WT sw.Hh::Qo
ldc.i4.s 50
ldc.i4 550
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01D0: nop
ldc.i4.0 <null>
stloc.s V_1
br IL_0178: br IL_00C1
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_016C: nop
newobj System.Void mZ.V5::.ctor()
stsfld mZ.V5 sw.Hh::QQ
br IL_0182: newobj System.Void tv.pI::.ctor()
nop <null>
ldsfld NbE.dbW sw.Hh::XO
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_01A1: nop
nop <null>
ret <null>
ldloc.s V_1
ldc.i4 500
clt <null>
stloc.s V_2
br IL_001B: ldloc.s V_2
nop <null>
newobj System.Void System.Random::.ctor()
stloc.s V_3
br IL_008D: ldc.i4.0
nop <null>
ldsfld System.Single[] sw.Hh::N4
ldloc.s V_1
ldloc.s V_3
ldc.i4.0 <null>
ldc.i4 300
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldc.i4 1
ldsfld <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62} <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_dc2180b4b1994272966a9aaf2c02fe85
ldfld System.Int32 <Module>{5324d3c0-efdd-46a1-a747-4f998a162b62}::m_5d2c9614ff95401b9820b063529225ad
brfalse IL_0009: switch(IL_0071,IL_0052)
pop <null>
ldc.i4 1
br IL_0009: switch(IL_0071,IL_0052)
newobj System.Void NbE.dbW::.ctor()
stsfld NbE.dbW sw.Hh::XO
br IL_01C1: newobj System.Void Wz.WT::.ctor()
nop <null>
ldsfld tv.pI sw.Hh::Hk
ldc.i4 820
ldc.i4.s 50
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_01EC: nop
ldsfld System.Int32[] sw.Hh::au
ldloc.s V_1
ldc.i4.0 <null>
stelem.i4 <null>
br IL_01E0: nop
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4 820
ldc.i4 350
newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32)
callvirt System.Void System.Windows.Forms.Form::set_Location(System.Drawing.Point)
br IL_0027: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_01FD: call System.Void KbH.rb1::ejg()
br IL_00C1: ldloc.s V_1
br IL_00DE: nop
newobj System.Void tv.pI::.ctor()
stsfld tv.pI sw.Hh::Hk
br IL_0114: newobj System.Void NbE.dbW::.ctor()
nop <null>
ldsfld mZ.V5 sw.Hh::QQ
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00BF: nop
nop <null>
ldsfld Wz.WT sw.Hh::Qo
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_0191: nop
ldsfld tv.pI sw.Hh::Hk
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_0123: nop
newobj System.Void Wz.WT::.ctor()
stsfld Wz.WT sw.Hh::Qo
br IL_01B1: ldsfld tv.pI sw.Hh::Hk
nop <null>
ldsfld tv.pI sw.Hh::Hk
callvirt System.Void System.Windows.Forms.Control::Show()
br IL_00AF: nop
nop <null>
ldloc.s V_1
ldc.i4.1 <null>
add <null>
stloc.s V_1
br IL_00C1: ldloc.s V_1
nop <null>
ldsfld NbE.dbW sw.Hh::XO
ldc.i4.0 <null>
callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition)
br IL_014D: nop
call System.Void KbH.rb1::ejg()
br IL_00D1: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙