Deep Malware Analysis of 0799647e12f7c7cad1bc211009632394 | md5: 0799647e12f7c7cad1bc211009632394 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.84

PE Executable

MD5: 0799647e12f7c7cad1bc211009632394

Size: 1.27 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	0799647e12f7c7cad1bc211009632394
Sha1	5d2449adcc75774d3919ba10cd6f1e1360485857
Sha256	76ed78255fcc7085a301b43e6fe98ca38a0563e22be70be2afa7be8dfd4b3148
Sha384	ac630e19cfd4380694b6fbdcf3d36ddcd32147a05be4871467eef4864d0bc7afc96ab242a93ce0599d76ee4d7c0257e9
Sha512	7a621a0e260c11c8fa10d2af44008b0efe5eb7ba995a2725fabecda7d027f1e984f6b0c04d78f6f1e20a38bcaa4175e93df25c6b61b21dfc3ea65a7dc6976e2f
SSDeep	24576:/h64Cj887V0e0Oh0/uKjFuv2XjgZQzrdA:/h6488uV0Lc6frXEKFA
TLSH	0E45DF1A2BC92EF0E17B9F359275025007F0B617C232E75E6994F3F8CE92B999512363

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Ns2mytF93wjDK1
Full Name	Ns2mytF93wjDK1
EntryPoint	System.Void Ns2mytF93wjDK1.Jag6s8Aiyw2KPb/xWw4j.jo0XpYb5P::bd1R4S()
Scope Name	Ns2mytF93wjDK1
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ns2mytF93wjDK1
Assembly Version	23.20.4.294
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1175
Main Method	System.Void Ns2mytF93wjDK1.Jag6s8Aiyw2KPb/xWw4j.jo0XpYb5P::bd1R4S()
Main IL Instruction Count	32
Main IL	nop <null> nop <null> ldc.i4.s 20 stloc.0 <null> newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor() stloc.1 <null> ldloc.0 <null> stloc.2 <null> ldc.i4.1 <null> stloc.3 <null> br.s IL_001D: ldloc.3 ldloc.1 <null> ldloc.3 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.3 <null> ldc.i4.1 <null> add.ovf <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ble.s IL_0011: ldloc.1 ldstr demandflatteningrules call System.Void Ns2mytF93wjDK1.Mqj2cW3i::Gm7kr8qF3zYj_b(System.String) nop <null> leave.s IL_003B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_003B: nop nop <null> ret <null>
Module Name	Ns2mytF93wjDK1
Full Name	Ns2mytF93wjDK1
EntryPoint	System.Void Ns2mytF93wjDK1.Jag6s8Aiyw2KPb/xWw4j.jo0XpYb5P::bd1R4S()
Scope Name	Ns2mytF93wjDK1
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ns2mytF93wjDK1
Assembly Version	23.20.4.294
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1175
Main Method	System.Void Ns2mytF93wjDK1.Jag6s8Aiyw2KPb/xWw4j.jo0XpYb5P::bd1R4S()
Main IL Instruction Count	32
Main IL	nop <null> nop <null> ldc.i4.s 20 stloc.0 <null> newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor() stloc.1 <null> ldloc.0 <null> stloc.2 <null> ldc.i4.1 <null> stloc.3 <null> br.s IL_001D: ldloc.3 ldloc.1 <null> ldloc.3 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.3 <null> ldc.i4.1 <null> add.ovf <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ble.s IL_0011: ldloc.1 ldstr demandflatteningrules call System.Void Ns2mytF93wjDK1.Mqj2cW3i::Gm7kr8qF3zYj_b(System.String) nop <null> leave.s IL_003B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_003B: nop nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.