Malicious
Malicious

PE Executable
MD5: 0d143aa10eae99e51887ebcf9bf82042
Size: 1.5 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0d143aa10eae99e51887ebcf9bf82042
Sha1 427de648f397954ee7e7523fb0e6e9fb9d0859c7
Sha256 5928fc679943aca8e9c19dd90d57ef8b4bf871b9b5b79e6c6acbcac9cd301d7e
Sha384 7abe8ab8538055586f34c6f3710bab89a5800790e842587ff75faf56dfbc15e17f59e677db1d2b9a94d1bfcba7d0fbbb
Sha512 7481fe5a0683c2341d4f544f697d4f1133356b303b793d11381de6c906aeaf667c9d8478f9c12f38e2b0de99316b7abef2262987d2843e4a69977c494d3e3711
SSDeep 24576:dZMMkehlV2LQ8G29L0BNzZc6QRGJJDHu77RuZSOB/3fhRC:dZM2CVecYJy7WSOB/3
TLSH C6658D417E44CE51F0191633C2EF49884BB0995176A6E32B7DBA37BE55223A73C0DACB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
0d143aa10eae99e51887ebcf9bf82042
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
kcNpfRBvZ1t78lr6E1.GK6FPv9i7y7wExrgVb
13XMR9ncEQAjAkWW3h.UaEgCj3FIEnDEAx53m
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
Full Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
EntryPoint
System.Void XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::OJ6cnIHkrO()
Scope Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PdY0UHRdio34VMYTHj61OUYhzDc8n81pvmHIJ2dkt23d
Assembly Version
1.7.2.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::OJ6cnIHkrO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void aFpMjlHWCBpTUVNtRIx.odTbFDHaXaRkWao1WkL::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::KRwcOpEmqE
callvirt System.Void xfe3FCsaswhNxaTa1VI.toUujVsMkGfJH0DbR90::y9pGvkMq8U()
nop <null>
ret <null>
Module Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
Full Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
EntryPoint
System.Void XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::OJ6cnIHkrO()
Scope Name
0Yn2kwhnbpgpJKIi7kXmhtyrBWcIFllErgMR2L
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
PdY0UHRdio34VMYTHj61OUYhzDc8n81pvmHIJ2dkt23d
Assembly Version
1.7.2.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::OJ6cnIHkrO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void aFpMjlHWCBpTUVNtRIx.odTbFDHaXaRkWao1WkL::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object XvALXms0rnsKXWRSUow.k0aRj9sOcumUWAJvrEw::KRwcOpEmqE
callvirt System.Void xfe3FCsaswhNxaTa1VI.toUujVsMkGfJH0DbR90::y9pGvkMq8U()
nop <null>
ret <null>
0d143aa10eae99e51887ebcf9bf82042
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
kcNpfRBvZ1t78lr6E1.GK6FPv9i7y7wExrgVb
13XMR9ncEQAjAkWW3h.UaEgCj3FIEnDEAx53m
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙