Suspicious
Suspect

01dd996e983f6f00fb477171e9830189

Share on LinkedIn
Print
PE Executable
MD5: 01dd996e983f6f00fb477171e9830189
Size: 2.37 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 01dd996e983f6f00fb477171e9830189
Sha1 0c79e38c9f2cb5c797792729b10391b58ada94a3
Sha256 fe3dd2365097e3f899d393f8a006ca7e8f57fdb027e746c027921b331a0f778e
Sha384 e7afd21c003ff78743036465a379ddb0f88dbfc24d840821bbb62bd67805e1300de11891257c274656f20d576a081643
Sha512 a55e7241a3dfc3fbfe72105dd55db7b21c191cea19e3324e37c5e333cd0f8d89d0b28d50279086a36d64e83bf648817f5ef9a711f2a049ac2b5bb835f98e5b44
SSDeep 49152:di346EUbowEOvygS7/1sHOqJ02nTPFdRPqxMaiDza9nVQc6w:diILUcwti78OqJ7TPB3uN6
TLSH 05B533048FBA568BF029B7FCE0B74D44A1B692756B21EB5CC8C9B3DC8B05B844F952D1
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
01dd996e983f6f00fb477171e9830189
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CB.C.version.txt
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.microsoft.bcl.asyncinterfaces.dll.compressed
costura.microsoft.bcl.asyncinterfaces.dll
[Authenticode]_5bf00412.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.dependencyinjection.dll.compressed
costura.microsoft.extensions.dependencyinjection.dll
.Net Resources
FxResources.Microsoft.Extensions.DependencyInjection.SR.resources
ILLink.Substitutions.xml
[Authenticode]_20b651b7.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.dependencyinjection.abstractions.dll.compressed
costura.microsoft.extensions.dependencyinjection.abstractions.dll
.Net Resources
FxResources.Microsoft.Extensions.DependencyInjection.Abstractions.SR.resources
ILLink.Substitutions.xml
[Authenticode]_a48cef96.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.logging.dll.compressed
costura.microsoft.extensions.logging.dll
.Net Resources
FxResources.Microsoft.Extensions.Logging.SR.resources
ILLink.Substitutions.xml
[Authenticode]_61ef7f60.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.logging.abstractions.dll.compressed
costura.microsoft.extensions.logging.abstractions.dll
.Net Resources
FxResources.Microsoft.Extensions.Logging.Abstractions.SR.resources
ILLink.Substitutions.xml
[Authenticode]_bf2357d8.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.options.dll.compressed
costura.microsoft.extensions.options.dll
.Net Resources
FxResources.Microsoft.Extensions.Options.SR.resources
ILLink.Substitutions.xml
[Authenticode]_b42dfc3d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.extensions.primitives.dll.compressed
costura.microsoft.extensions.primitives.dll
.Net Resources
FxResources.Microsoft.Extensions.Primitives.SR.resources
ILLink.Substitutions.xml
[Authenticode]_39a6ad95.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.bouncycastle.crypto.dll.compressed
costura.bouncycastle.crypto.dll
[Authenticode]_f0ba58a2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.protobuf-net.dll.compressed
costura.protobuf-net.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
.Net Resources
FxResources.System.Buffers.SR.resources
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_0795effd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
costura.system.memory.dll
.Net Resources
FxResources.System.Memory.SR.resources
[Authenticode]_8f789375.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.threading.tasks.extensions.dll.compressed
costura.system.threading.tasks.extensions.dll
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
costura.system.valuetuple.dll
.Net Resources
FxResources.System.ValueTuple.SR.resources
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.ca.mo.dll.compressed
costura.ca.mo.dll
.Net Resources
costura.metadata
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void CBQ.Program::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
387
Main Method
System.Void CBQ.Program::Main()
Main IL Instruction Count
4
Main IL 
call System.Void CBQ.Program::ConfigureApplication()
newobj System.Void CBQ.CBQ::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void CBQ.Program::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
387
Main Method
System.Void CBQ.Program::Main()
Main IL Instruction Count
4
Main IL 
call System.Void CBQ.Program::ConfigureApplication()
newobj System.Void CBQ.CBQ::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙