Suspicious
Suspect

PE Executable
MD5: 05eff3687b1d07224a53f24b84a3f91f
Size: 1.17 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 05eff3687b1d07224a53f24b84a3f91f
Sha1 394c22ad052fa413679540b1715f0c4eac651f2e
Sha256 43bf0e585ed703c5aa53e6a74b04e2b3c10a3a7708889a5d823c7f84e29c2aab
Sha384 0538ddc8aa1aca13d42368e752cbe83d6b11d9ab0cedb9e684b277177d6b2b9981bd8a7e3a42a556c2e88db41a6bebd6
Sha512 2d83ab807cd09ccf7594aa9a748552953ce18f3d348612b42cabaee9a6978106fee1dc5e38a0329010b82005e6141a7a7fe1e81c10deb57e2840a5e423b0abfc
SSDeep 12288:+lNE5UWAkO1M9jH95v5Sg7SvGLzHhWbmcd0lMs8Gbrizvpprbwt/UGldwxpAbnAJ:+lNjE1H9tdlt7rewiDSP4Z
TLSH 0D4541342EEA502AF173AF7D8AE47596DA5EBBA33707985D00B103C60723A42DDD153E
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
05eff3687b1d07224a53f24b84a3f91f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
Full Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
EntryPoint
System.Void koZ.91s::476()
Scope Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EIQh4ObUBs8gPL81xZK0b3WOrA37w
Assembly Version
7.5.2.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1773
Main Method
System.Void koZ.91s::476()
Main IL Instruction Count
5
Main IL 
nop <null>
ldsfld 8I8.9A9 koZ.91s::627
callvirt System.Void 8I8.9A9::wTq()
nop <null>
ret <null>
Module Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
Full Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
EntryPoint
System.Void koZ.91s::476()
Scope Name
IPqgFqUzdxcPkRF1xSJu8U0fpnw7kvxjSyjkll
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EIQh4ObUBs8gPL81xZK0b3WOrA37w
Assembly Version
7.5.2.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1773
Main Method
System.Void koZ.91s::476()
Main IL Instruction Count
5
Main IL 
nop <null>
ldsfld 8I8.9A9 koZ.91s::627
callvirt System.Void 8I8.9A9::wTq()
nop <null>
ret <null>
05eff3687b1d07224a53f24b84a3f91f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙