Malicious
Malicious

00a482e809d8ccf99944e35942d6e189

PE Executable
MD5: 00a482e809d8ccf99944e35942d6e189
Size: 1.22 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 00a482e809d8ccf99944e35942d6e189
Sha1 43ac909d1e1203a4f64023232e8c21d119000537
Sha256 c86a6f67c7b7243f5d92cded7866092a45ee12e10e331269eb5c54f2ee7e7282
Sha384 c4f447269749931fc720b1a710640a85951f14bf1a6f9525159c4deb32ea2c887a528a223bfabc718b605e06dcac68c7
Sha512 23ac8e7b8fcab5a9be55eec1bf43e1946a7d42acb9574ef25af1f7014d067a1f716706ab48487bc1df7e6db3fd040c358f829082643f41ff0faac938f615fccc
SSDeep 24576:+wViq45UlrVhePSnjIYTJ2YrroQRbOTLYfSf5vODG7TmolS:mYZh/j3JRRbOHzgB
TLSH C2455A017E44CE11F0199633C2EF454887B09A5566B6E32B7DBA377E26623A73C0D9CB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
00a482e809d8ccf99944e35942d6e189
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
91Dryq7DtwEwRgCYy8.6gP5nhcJin87WL4YVA
MZaeCOWDf5RS4Je44Z.FqI06xD6DrtlcPPQ5m
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
EtQKsFW2DfnniB9
Full Name
EtQKsFW2DfnniB9
EntryPoint
System.Void WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::L5a5TtDZAK()
Scope Name
EtQKsFW2DfnniB9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ulmzjbfBklKK8s6vdZcgMvv3VRGaNtKk7
Assembly Version
4.5.9.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::L5a5TtDZAK()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void hpNUOR5OOU0RnyMeg49.hjnUXR5AWhvAc0NpZNg::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::MUY5NhKWFX
callvirt System.Void UusquoPA9Y8YbsU5IwX.Ps1ogWPKseelMhGG32t::QmNljoBQSg()
nop <null>
ret <null>
Module Name
EtQKsFW2DfnniB9
Full Name
EtQKsFW2DfnniB9
EntryPoint
System.Void WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::L5a5TtDZAK()
Scope Name
EtQKsFW2DfnniB9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ulmzjbfBklKK8s6vdZcgMvv3VRGaNtKk7
Assembly Version
4.5.9.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::L5a5TtDZAK()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void hpNUOR5OOU0RnyMeg49.hjnUXR5AWhvAc0NpZNg::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object WCG5RHPn8SJAte0rJKn.WAdxloPbqKWmagXfaOm::MUY5NhKWFX
callvirt System.Void UusquoPA9Y8YbsU5IwX.Ps1ogWPKseelMhGG32t::QmNljoBQSg()
nop <null>
ret <null>
00a482e809d8ccf99944e35942d6e189
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
91Dryq7DtwEwRgCYy8.6gP5nhcJin87WL4YVA
MZaeCOWDf5RS4Je44Z.FqI06xD6DrtlcPPQ5m
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙