Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Very low
5 files
EXEfe75224216b7f097321e552f4d24f0c6
Structure
Name Value
Module Name
HsDr.exe
Full Name
HsDr.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
HsDr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HsDr
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
33
Main IL 
ldc.i4.4 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.AsyncForm59::Ⴈ()
ldc.i4 235
ldc.i4 173
call System.Void SecureMode.Properties.Resources::Ⴄ(System.Int32,System.Int16)
ldc.i4.0 <null>
ldc.i4 878
ldc.i4 823
call System.Void SecureMode.ProfessionalForm65::Ⴓ(System.Boolean,System.Int32,System.Char)
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4 249
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4 249
ldelem.u2 <null>
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4.6 <null>
ldelem.u2 <null>
xor <null>
ldc.i4.s 46
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Module Name
HsDr.exe
Full Name
HsDr.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
HsDr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HsDr
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
33
Main IL 
ldc.i4.4 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.AsyncForm59::Ⴈ()
ldc.i4 235
ldc.i4 173
call System.Void SecureMode.Properties.Resources::Ⴄ(System.Int32,System.Int16)
ldc.i4.0 <null>
ldc.i4 878
ldc.i4 823
call System.Void SecureMode.ProfessionalForm65::Ⴓ(System.Boolean,System.Int32,System.Char)
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4 249
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4 249
ldelem.u2 <null>
ldsfld System.Char[] SecureMode.PrimaryForm58::Ⴐ
ldc.i4.6 <null>
ldelem.u2 <null>
xor <null>
ldc.i4.s 46
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙