0f1d42cb6725d8194145cff1d3683634

PE Executable

MD5: 0f1d42cb6725d8194145cff1d3683634

Size: 920.58 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	0f1d42cb6725d8194145cff1d3683634
Sha1	d9c19f966ff9cadfb515586114754d7ddf2381e7
Sha256	4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
Sha384	ab2b091c73bacfa378af930688e8a682a0e44da465fc9860ff9a16ce89c408c1de5dd30f3bc7dec97597a1de12d39eed
Sha512	3090fa461d46f561b52c0929458050c07091519c30f1a9a31b76c2031f384d5989dbc3183824f2ce9bcf36d03ba9830b78462aac7335b72f7083fbef4cdc938c
SSDeep	12288:WlQE+W8AQEUd6SZzpX8zmt/C7Ra3r40wChB94Ux5eq8sewIk0YPgHKf6sk+KDXeL:4QTYKX8L7IsMxd8eCYPNfD4z/93
TLSH	2C15D04432ABEC03D4724BB009E1D37087B96F95E521E3574FE66ED77A26BC26484B83

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Module Name	lcZS.exe
Full Name	lcZS.exe
EntryPoint	System.Void QC.sI::PU()
Scope Name	lcZS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lcZS
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	728
Main Method	System.Void QC.sI::PU()
Main IL Instruction Count	15
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_000B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0017: call System.Void C8u.x8a::DHO() call System.Void C8u.x8a::DHO() br IL_0021: nop nop <null> newobj System.Void kM.Bu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0031: nop nop <null> ret <null>`
Module Name	lcZS.exe
Full Name	lcZS.exe
EntryPoint	System.Void QC.sI::PU()
Scope Name	lcZS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lcZS
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	728
Main Method	System.Void QC.sI::PU()
Main IL Instruction Count	15
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_000B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0017: call System.Void C8u.x8a::DHO() call System.Void C8u.x8a::DHO() br IL_0021: nop nop <null> newobj System.Void kM.Bu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0031: nop nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.