Suspicious
Suspect

00c9a07361db57e58683ee05e121021f

Share on LinkedIn
Print
PE Executable
MD5: 00c9a07361db57e58683ee05e121021f
Size: 1.19 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 00c9a07361db57e58683ee05e121021f
Sha1 6eeed9124fe56fa32f71f18b1c52e53f6ba5f0c5
Sha256 912b95083237514092192e42707678f79b68e2ff8a95c6fc456eaba3f44774c5
Sha384 d46af58fbcb9adaedeb159179b657b64c3ce9523f8db09c06fa14a6d55ad6ee8c519b0a2ae1efe5ec38ee650f68f5c26
Sha512 f08a4416f4492d48799be5300984a1c738f4fdf6731e56cfee0e669fd7ff221b90f23f2a7c4cfc125c262730fe0474d003b5d9f1919138d494697f223ab1754a
SSDeep 24576:4y6ChN0KdUopwfb2eThsGhQEMHoDG6UIT2KI5g:7nZ2LG6ENg
TLSH A045319C765075CFCC5BCD72DEA81C64E66078AB670BE207A85316EC9A0D59BDF080F2
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
00c9a07361db57e58683ee05e121021f
[Authenticode]_5d6d2268.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
SimpleRunPE.exe
Full Name
SimpleRunPE.exe
EntryPoint 
System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‫‮‏‬​‭‫‌‬‫‮‌‏‏‍‪‪‪​‏‍‍‏‫‭‮(System.String[])
Scope Name
SimpleRunPE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SimpleRunPE
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x123200 size 1600 bytes
Info
PDB Path: SimpleRunPE.pdb
Total Strings
327
Main Method 
System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‫‮‏‬​‭‫‌‬‫‮‌‏‏‍‪‪‪​‏‍‍‏‫‭‮(System.String[])
Main IL Instruction Count
27
Main IL 
ldarg.0 <null>
call System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‎‎‭‭‌​‮‎‪‎‍‎‎‌‍‪‏‏‭‎‍‬‪‪​‪‏​‪‎‮(System.String[])
leave.s IL_003F: ret
stloc.0 <null>
ldc.i4 -549233426
br.s IL_0010: call System.String <Module>::‬​‬‪‎‬‬‪‎‫‌‏‮‍‏‏‫‬​‍‫​‭‪‮<System.String>(System.Int32)
call System.String <Module>::‬​‬‪‎‬‬‪‎‫‌‏‮‍‏‏‫‬​‍‫​‭‪‮<System.String>(System.Int32)
ldloc.0 <null>
dup <null>
brtrue.s IL_001D: callvirt System.String System.Object::ToString()
pop <null>
ldnull <null>
br.s IL_0022: call System.String System.String::Concat(System.String,System.String)
callvirt System.String System.Object::ToString()
call System.String System.String::Concat(System.String,System.String)
ldnull <null>
call System.Void ‏‭‭‫‫‏​‍‌‏‎‎‏‌‏‬‏‪‎‮‫​‮‬‌‬‏‫‮::‎‭‎​​‌‬‪‮‭​​‭‬​‏​‍​‎‬‎‌‮(System.String,System.Exception)
leave.s IL_0032: nop
pop <null>
leave.s IL_0032: nop
nop <null>
call System.Void ‮‏‍‫‫​‎​​‫‫​​‬‏‮‌‭‍‬​‫‎‮::‏‌‮‫‫‎‬‏‏‎‭‮‏​‮‌‪‍‪‍‎‮​‭‪​‬‮‪‮()
leave.s IL_003D: leave.s IL_003F
pop <null>
leave.s IL_003D: leave.s IL_003F
leave.s IL_003F: ret
ret <null>
Module Name
SimpleRunPE.exe
Full Name
SimpleRunPE.exe
EntryPoint 
System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‫‮‏‬​‭‫‌‬‫‮‌‏‏‍‪‪‪​‏‍‍‏‫‭‮(System.String[])
Scope Name
SimpleRunPE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SimpleRunPE
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
327
Main Method 
System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‫‮‏‬​‭‫‌‬‫‮‌‏‏‍‪‪‪​‏‍‍‏‫‭‮(System.String[])
Main IL Instruction Count
27
Main IL 
ldarg.0 <null>
call System.Void ‭‫‪‎‮‎‭‬​‮‫‪‍​‪‍‎‏‬‫‫‪‮‬​‏‪‮::‎‎‭‭‌​‮‎‪‎‍‎‎‌‍‪‏‏‭‎‍‬‪‪​‪‏​‪‎‮(System.String[])
leave.s IL_003F: ret
stloc.0 <null>
ldc.i4 -549233426
br.s IL_0010: call System.String <Module>::‬​‬‪‎‬‬‪‎‫‌‏‮‍‏‏‫‬​‍‫​‭‪‮<System.String>(System.Int32)
call System.String <Module>::‬​‬‪‎‬‬‪‎‫‌‏‮‍‏‏‫‬​‍‫​‭‪‮<System.String>(System.Int32)
ldloc.0 <null>
dup <null>
brtrue.s IL_001D: callvirt System.String System.Object::ToString()
pop <null>
ldnull <null>
br.s IL_0022: call System.String System.String::Concat(System.String,System.String)
callvirt System.String System.Object::ToString()
call System.String System.String::Concat(System.String,System.String)
ldnull <null>
call System.Void ‏‭‭‫‫‏​‍‌‏‎‎‏‌‏‬‏‪‎‮‫​‮‬‌‬‏‫‮::‎‭‎​​‌‬‪‮‭​​‭‬​‏​‍​‎‬‎‌‮(System.String,System.Exception)
leave.s IL_0032: nop
pop <null>
leave.s IL_0032: nop
nop <null>
call System.Void ‮‏‍‫‫​‎​​‫‫​​‬‏‮‌‭‍‬​‫‎‮::‏‌‮‫‫‎‬‏‏‎‭‮‏​‮‌‪‍‪‍‎‮​‭‪​‬‮‪‮()
leave.s IL_003D: leave.s IL_003F
pop <null>
leave.s IL_003D: leave.s IL_003F
leave.s IL_003F: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙