Deep Malware Analysis of 09c25b2ddb8d1b7b8d67fba2c8c9a76b | md5: 09c25b2ddb8d1b7b8d67fba2c8c9a76b | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.07

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	09c25b2ddb8d1b7b8d67fba2c8c9a76b
Sha1	0f5a4957a9574b4ddeb507589af6da5149e58005
Sha256	49ca026d8d0b9af34ff8daeca673475a84d249fba5c6a8204b8f9a15c0145820
Sha384	bbb90af26e172fecfa62fc771794fd06826f9180a9e341bb4480fd4674e7635c3f96f9a8dd1a2ee3f915c228513d0863
Sha512	d003fd7a2415ce6d9674f3560e141d885f856809b67948cb7fbc7675afcc9682fcef68fe1ca5796c535ab1f19cd852113d6c63898d2de1b21d147aaa0772d700
SSDeep	24576:1EOpxLJg3LJdnXgSvRukriMcGrON6uvHA:+0o3LJdnXgSvkkriFGypvg
TLSH	3945E00072B84F4AE47A47F80166D63083F65E5D657EE7098EEEBCEB7960B011B94B13

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	xjff.exe
Full Name	xjff.exe
EntryPoint	System.Void QLNS.Program::Main()
Scope Name	xjff.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xjff
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1919
Main Method	System.Void QLNS.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void QLNS.FrmMain::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`
Module Name	xjff.exe
Full Name	xjff.exe
EntryPoint	System.Void QLNS.Program::Main()
Scope Name	xjff.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xjff
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1919
Main Method	System.Void QLNS.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void QLNS.FrmMain::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

Embedded Resources UNKNWOWNsuspect

1huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential