0a7527626bfbc9702ad9fe8428889361

PE Executable

MD5: 0a7527626bfbc9702ad9fe8428889361

Size: 784.38 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	0a7527626bfbc9702ad9fe8428889361
Sha1	6eddd24221c19404b63350c2aee80bf919577d69
Sha256	e76c5c79066d31f5e84b172d61ba575926a18505efa47a9d9a0c7c1c0ced4768
Sha384	7652292348a3fb4818f179a6dca28b6ec9554a7cf1cd78db7cbb1c1b5c20467f04977210dbc52915d42b16f849fe2050
Sha512	f29b1a93a3c80cdebb4aff5134a258f98ef51219c6accadadda83b1de40d546af055a3c97c4efaaf5ffbfa8ca3dd14aaace26e39fc999dfcd1d5515801229b64
SSDeep	12288:ncObdlm/X5xiMbSNk5Wpvnbzf4hu6yoRH+EkEMzEqBlvZO1XTHwZv/vztBYto2DN:cOOSR1n/4hDLHoEfcONcxb06
TLSH	AEF4F1286A5FDD13C47A077148E0F67413B15E8DE522D38B8EEE6DE73A21BC55CD8282

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	Zsbw.exe
Full Name	Zsbw.exe
EntryPoint	System.Void Yj.EQ::Ay()
Scope Name	Zsbw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zsbw
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	417
Main Method	System.Void Yj.EQ::Ay()
Main IL Instruction Count	16
Main IL	br IL_0011: nop call System.Void wc5.Qcw::INq() br IL_001C: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_002C: nop nop <null> newobj System.Void OMC.RMT::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_000F: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0005: call System.Void wc5.Qcw::INq()
Info	PE Detect: PeReader OK (file layout)
Module Name	Zsbw.exe
Full Name	Zsbw.exe
EntryPoint	System.Void Yj.EQ::Ay()
Scope Name	Zsbw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zsbw
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	417
Main Method	System.Void Yj.EQ::Ay()
Main IL Instruction Count	16
Main IL	br IL_0011: nop call System.Void wc5.Qcw::INq() br IL_001C: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_002C: nop nop <null> newobj System.Void OMC.RMT::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_000F: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0005: call System.Void wc5.Qcw::INq()

No malware configuration was found at this point.

You must be signed in to view YARA rules.