Suspicious
Suspect

055e7518f420db989a9d4d38ca82556a

PE Executable
MD5: 055e7518f420db989a9d4d38ca82556a
Size: 57.45 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 055e7518f420db989a9d4d38ca82556a
Sha1 6f9467c303ac17202d92ea1e252a0e03ccf6a261
Sha256 1c5f7d730c6cdff7b0027609aa654da0d8602002e4e2d44d05a9c544b6c54b1e
Sha384 1cf20a415648aed7df0b90018114bc4aa41bc537d6ae7a3bd2e31d9287b023322fe36bc72395b91253cc2f262a32fb34
Sha512 ae3ee16f38071d5652b69637b18e8e1740d60a011c98fe16b1a738e5dc63027372e0bae8347c8e97162e9f6fd5422e2cd023868f573f2f022c68af39dacdf037
SSDeep 768:6HIh/m3djYugK42asIxEooBmvox//KBH/ySL4HGL382ADurA+d8fm82ADs8Lrk+X:6ohRumERsgx//k/y1Hc8tOam8toykI
TLSH 87437C408B5E9837DE4E497CB4B252130BB6D21375C1D28FAD9C85E52A833D81A5A3FE
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
055e7518f420db989a9d4d38ca82556a
[Authenticode]_202aea1c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
           
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x8E00 size 21096 bytes
Module Name
Lecoos.exe
Full Name
Lecoos.exe
EntryPoint
System.Void  ::()
Scope Name
Lecoos.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lecoos
Assembly Version
1.3.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
0
Main Method
System.Void  ::()
Main IL Instruction Count
46
Main IL 
newobj System.Void  ::.ctor()
call System.Boolean  ::()
brfalse.s IL_005F: call System.Boolean  ::()
call System.Boolean  ::()
pop <null>
call System.IntPtr  ::()
stloc.1 <null>
ldloc.1 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_002D: ldsfld System.IntPtr System.IntPtr::Zero
ldloc.1 <null>
ldc.i4.0 <null>
call System.Boolean  ::(System.IntPtr,System.Int32)
pop <null>
ldsfld System.IntPtr System.IntPtr::Zero
ldc.i4 1812299834
call System.String ::(System.Int32)
call System.String  ::(System.String)
ldc.i4 1812301607
call System.String ::(System.Int32)
call System.String  ::(System.String)
ldc.i4.s 16
call System.Int32  ::(System.IntPtr,System.String,System.String,System.UInt32)
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Boolean  ::()
pop <null>
call System.IntPtr  ::()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_0080: call System.Threading.Tasks.Task  ::()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Boolean  ::(System.IntPtr,System.Int32)
pop <null>
call System.Threading.Tasks.Task  ::()
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.2 <null>
ldloca.s V_2
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ret <null>
Module Name
Lecoos.exe
Full Name
Lecoos.exe
EntryPoint
System.Void  ::()
Scope Name
Lecoos.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lecoos
Assembly Version
1.3.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
0
Main Method
System.Void  ::()
Main IL Instruction Count
46
Main IL 
newobj System.Void  ::.ctor()
call System.Boolean  ::()
brfalse.s IL_005F: call System.Boolean  ::()
call System.Boolean  ::()
pop <null>
call System.IntPtr  ::()
stloc.1 <null>
ldloc.1 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_002D: ldsfld System.IntPtr System.IntPtr::Zero
ldloc.1 <null>
ldc.i4.0 <null>
call System.Boolean  ::(System.IntPtr,System.Int32)
pop <null>
ldsfld System.IntPtr System.IntPtr::Zero
ldc.i4 1812299834
call System.String ::(System.Int32)
call System.String  ::(System.String)
ldc.i4 1812301607
call System.String ::(System.Int32)
call System.String  ::(System.String)
ldc.i4.s 16
call System.Int32  ::(System.IntPtr,System.String,System.String,System.UInt32)
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Boolean  ::()
pop <null>
call System.IntPtr  ::()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_0080: call System.Threading.Tasks.Task  ::()
ldloc.0 <null>
ldc.i4.0 <null>
call System.Boolean  ::(System.IntPtr,System.Int32)
pop <null>
call System.Threading.Tasks.Task  ::()
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.2 <null>
ldloca.s V_2
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ret <null>
055e7518f420db989a9d4d38ca82556a
[Authenticode]_202aea1c.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
           
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙