Deep Malware Analysis of 091e02b9f037a928027db9245da16048 | md5: 091e02b9f037a928027db9245da16048 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.45

PE Executable

MD5: 091e02b9f037a928027db9245da16048

Size: 713.75 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	091e02b9f037a928027db9245da16048
Sha1	822b5f233884598a7bc53f22a6bd053056bf22e9
Sha256	638f2c7df9e6ccf5434702ba2eb14685f68a310fc5bfa2780b168376e24de678
Sha384	26eb5b2701d5075670c656b8ed6b50b3103bc3e0d8a73bd9e5f0805c0620d6e0b9154b3f1d4d551bbccd26a980be8505
Sha512	d0c430144782822fe2fcd86818f0d48c16621a0d0528de3032a568170c51b0f6970b46fdc3d985f5016ae866c22a655c28a032ea20ca44fb9695d6b158b9f677
SSDeep	12288:s+0uzc30OTMfwwOlz7hIY53cMs3+YDOuHE35Cgc2vCSUfAT9azKKMhvYU8NEB+PL:v07AfrShIY5sRPEgMCSb94bMhvYU8W+j
TLSH	C1E41218262AF603C9222B762EB1F5750B781CA9F901D6178ED93DEFB876F100D406E7

PeID

UPolyX 0.3 -> delikon

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_25fc2a52.bin (4628 bytes)
Info	PDB Path: Tbra.pdb
Module Name	Tbra.exe
Full Name	Tbra.exe
EntryPoint	System.Void BirthdayParadox.Program::Main()
Scope Name	Tbra.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Tbra
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	152
Main Method	System.Void BirthdayParadox.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void BirthdayParadox.Forms.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.