Suspicious
Suspect

0bf9c0b1d4a43f5986fa08f087b04cae

Share on LinkedIn
Print
PE Executable
MD5: 0bf9c0b1d4a43f5986fa08f087b04cae
Size: 215.04 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
Sha1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
Sha256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
Sha384 e9108ef4f4756d3900387e785200abfde1f66ff2d880ce0465fd30035164140150e9a724da7883523adc169479095b42
Sha512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDeep 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH 8B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0bf9c0b1d4a43f5986fa08f087b04cae
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.GridSize
$this.Icon
[NBF]root.IconData
$this.Language
progressBar1.Modifiers
ns0.GForm0.resources
$this.Icon
[NBF]root.IconData
ns0.GForm2.resources
art.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pŒdŸšuŽtˆjyˆ†re4.b2v5d™b7”ŒŸ8‘jœ
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void ns0.Form0::Main(System.String[])
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
293
Main Method
System.Void ns0.Form0::Main(System.String[])
Main IL Instruction Count
15
Main IL 
nop <null>
nop <null>
call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering()
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
nop <null>
leave.s IL_0013: call ns0.Form0 ns0.Class1::get_Form0_0()
nop <null>
nop <null>
endfinally <null>
call ns0.Form0 ns0.Class1::get_Form0_0()
ldarg.0 <null>
callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[])
nop <null>
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void ns0.Form0::Main(System.String[])
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
293
Main Method
System.Void ns0.Form0::Main(System.String[])
Main IL Instruction Count
15
Main IL 
nop <null>
nop <null>
call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering()
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
nop <null>
leave.s IL_0013: call ns0.Form0 ns0.Class1::get_Form0_0()
nop <null>
nop <null>
endfinally <null>
call ns0.Form0 ns0.Class1::get_Form0_0()
ldarg.0 <null>
callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[])
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙