Suspicious
Suspect

09684d5265a03f5cf621a27c28c9e3cb

PE Executable
MD5: 09684d5265a03f5cf621a27c28c9e3cb
Size: 24.58 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 09684d5265a03f5cf621a27c28c9e3cb
Sha1 0a829527c76d73a93d287e5fa978971f79b9db87
Sha256 d8c331aafba8356bdb3958c57a68e0865e0d05e7b13660b4f21b570ebb294621
Sha384 690faf460c8120c0585acbec7ac19bcf5ddf5f6501cd00f7a41b660850f8c9a27ed9e4b5285c56d647e28cf25422c380
Sha512 18235d08b6ce5b333e958485db0dc9fffae73538a835165cbc7422cee37b51fc7fc76abc4a3aea21379b98c1f243ceb889857a3b455e6a31f4a5ae0a7797100e
SSDeep 384:MRUTKv/lrFj5m4FDeJozWbKIrZe1BwcIJA0wBMxXKbYcXaJL7LQ5:VK3lTm4FqJoibKIte1OcWLwBsXvzJLHI
TLSH ECB20818BBCDAB73C2EE06BF44E376243370D9A1864BE74BB8C81A2D5A557D71012B47
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
09684d5265a03f5cf621a27c28c9e3cb
.Net Resources
{b0990441-bf8e-4fea-af26-62c42a8512fd}
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
PortTranC.exe
Full Name
PortTranC.exe
EntryPoint
System.Void .::(System.String[])
Scope Name
PortTranC.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PortTranC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
6
Main Method
System.Void .::(System.String[])
Main IL Instruction Count
134
Main IL 
nop <null>
br IL_0134: ldarg.0
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
ceq <null>
ldc.i4.3 <null>
brfalse.s IL_0008: ldc.i4.4
br IL_013A: stloc.s V_4
br IL_0141: ldloc.s V_4
brtrue.s IL_0057: nop
ldc.i4.5 <null>
brfalse.s IL_0051: nop
nop <null>
ldsfld  ::
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 172
br IL_0148: call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0152: call System.Void ::Invoke(System.String)
nop <null>
ldsfld  ::
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 197
br IL_015C: call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0166: call System.Void ::Invoke(System.String)
nop <null>
br IL_0133: ret
nop <null>
br IL_0121: ldarg.0
ldc.i4.0 <null>
ldelem.ref <null>
br IL_0127: stloc.0
ldsfld  ::
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 ::Invoke(System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
stloc.2 <null>
ldsfld  ::
ldarg.0 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Int32 ::Invoke(System.String)
stloc.3 <null>
ldc.i4.5 <null>
newarr System.Object
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 274
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldloc.s V_5
ldc.i4.1 <null>
ldloc.2 <null>
stelem.ref <null>
ldloc.s V_5
ldc.i4.2 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 311
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldloc.s V_5
ldc.i4.3 <null>
ldloc.3 <null>
box System.Int32
stelem.ref <null>
ldloc.s V_5
ldc.i4.4 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 316
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldsfld  ::
ldsfld  ::
ldloc.s V_5
call System.String ::Invoke(System.Object[])
call System.Void ::Invoke(System.String)
nop <null>
ldloc.3 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void .::(System.Int32,System.String,System.Int32,System.String)
nop <null>
ldloc.3 <null>
ldloc.2 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void .::(System.Int32,System.String,System.Int32,System.String)
nop <null>
ldc.i4.1 <null>
newarr System.Threading.ManualResetEvent
stloc.s V_6
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stelem.ref <null>
ldsfld  ::€
ldloc.s V_6
call System.Boolean ::Invoke(System.Threading.WaitHandle[])
pop <null>
nop <null>
leave.s IL_0132: nop
ldarg.0 <null>
br IL_005D: ldc.i4.0
stloc.0 <null>
br IL_0064: ldsfld  ::
pop <null>
nop <null>
nop <null>
leave.s IL_0132: nop
nop <null>
ret <null>
ldarg.0 <null>
br IL_0006: ldlen
stloc.s V_4
br IL_0013: br IL_0141
ldloc.s V_4
br IL_0018: brtrue.s IL_0057
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0032: br IL_0152
call System.Void ::Invoke(System.String)
br IL_0037: nop
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_004C: br IL_0166
call System.Void ::Invoke(System.String)
br IL_0051: nop
Info
PE Detect: PeReader OK (file layout)
Module Name
PortTranC.exe
Full Name
PortTranC.exe
EntryPoint
System.Void .::(System.String[])
Scope Name
PortTranC.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PortTranC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
6
Main Method
System.Void .::(System.String[])
Main IL Instruction Count
134
Main IL 
nop <null>
br IL_0134: ldarg.0
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
ceq <null>
ldc.i4.3 <null>
brfalse.s IL_0008: ldc.i4.4
br IL_013A: stloc.s V_4
br IL_0141: ldloc.s V_4
brtrue.s IL_0057: nop
ldc.i4.5 <null>
brfalse.s IL_0051: nop
nop <null>
ldsfld  ::
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 172
br IL_0148: call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0152: call System.Void ::Invoke(System.String)
nop <null>
ldsfld  ::
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 197
br IL_015C: call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0166: call System.Void ::Invoke(System.String)
nop <null>
br IL_0133: ret
nop <null>
br IL_0121: ldarg.0
ldc.i4.0 <null>
ldelem.ref <null>
br IL_0127: stloc.0
ldsfld  ::
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 ::Invoke(System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
stloc.2 <null>
ldsfld  ::
ldarg.0 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Int32 ::Invoke(System.String)
stloc.3 <null>
ldc.i4.5 <null>
newarr System.Object
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 274
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldloc.s V_5
ldc.i4.1 <null>
ldloc.2 <null>
stelem.ref <null>
ldloc.s V_5
ldc.i4.2 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 311
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldloc.s V_5
ldc.i4.3 <null>
ldloc.3 <null>
box System.Int32
stelem.ref <null>
ldloc.s V_5
ldc.i4.4 <null>
ldsfld SmartAssembly.Delegates.GetString .::
ldc.i4 316
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
stelem.ref <null>
ldsfld  ::
ldsfld  ::
ldloc.s V_5
call System.String ::Invoke(System.Object[])
call System.Void ::Invoke(System.String)
nop <null>
ldloc.3 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void .::(System.Int32,System.String,System.Int32,System.String)
nop <null>
ldloc.3 <null>
ldloc.2 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void .::(System.Int32,System.String,System.Int32,System.String)
nop <null>
ldc.i4.1 <null>
newarr System.Threading.ManualResetEvent
stloc.s V_6
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stelem.ref <null>
ldsfld  ::€
ldloc.s V_6
call System.Boolean ::Invoke(System.Threading.WaitHandle[])
pop <null>
nop <null>
leave.s IL_0132: nop
ldarg.0 <null>
br IL_005D: ldc.i4.0
stloc.0 <null>
br IL_0064: ldsfld  ::
pop <null>
nop <null>
nop <null>
leave.s IL_0132: nop
nop <null>
ret <null>
ldarg.0 <null>
br IL_0006: ldlen
stloc.s V_4
br IL_0013: br IL_0141
ldloc.s V_4
br IL_0018: brtrue.s IL_0057
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_0032: br IL_0152
call System.Void ::Invoke(System.String)
br IL_0037: nop
call System.String SmartAssembly.Delegates.GetString::Invoke(System.Int32)
br IL_004C: br IL_0166
call System.Void ::Invoke(System.String)
br IL_0051: nop
09684d5265a03f5cf621a27c28c9e3cb
.Net Resources
{b0990441-bf8e-4fea-af26-62c42a8512fd}
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙