Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 10699659e61063e1635332ea0cfd00f6
Size: 1.03 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 10699659e61063e1635332ea0cfd00f6
Sha1 8dd9767a8a2c4a1ffef8af6c1cee8d3734b658e9
Sha256 0418fd873b985dc519a55814dade5cc9bf9421ae0dbda9eba6995741fcdee668
Sha384 4a431b3bd2d35bcab1050d521dbded65d18a17126733dffd3717093bd958f8e747b428f5f3dd2201d0c4a065d6169068
Sha512 aa2f0f17c4cbbb5a2d31910ed1989cd091bf76580cc6446101bd91ea5facc01d7457f26411ff16d2705d8dab43349c8ed2b78d4a0ab7b543b2532844c70f99ee
SSDeep 24576:Cx30/Oee2vgzZwnciexv5cnl0mV0jEjOC3g:su5GZj5g50QZ
TLSH C8252901BE44CE11F0991A33D3EF4A484BB09D516AA6E31B7DBA376E16163933C1D9CB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
10699659e61063e1635332ea0cfd00f6
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
.Net Resources
6W5R8cs2P1T6gHcQJ4.L8B3vUTVg9W0kFThlu
fjxJaMOsBf7fLStxcd.i0pwK90RQ84eYONXGq
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
72Xen6
Full Name
72Xen6
EntryPoint
System.Void ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::QEMrEc9mwm()
Scope Name
72Xen6
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1YeIAIwxZF8HKLDBJLnZIXL7OJklLWSJS2pgzNeFWe4U
Assembly Version
7.3.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::QEMrEc9mwm()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void b6qcjhNHoMQQOCSkP65.KyqDsCNxllCwVL1onRL::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::MktrLMB9Ke
callvirt System.Void Bx6lRXwxuDKV5e0X7YJ.w5hfTJwiYluqtulNttD::eEYYFPgnIm()
nop <null>
ret <null>
Module Name
72Xen6
Full Name
72Xen6
EntryPoint
System.Void ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::QEMrEc9mwm()
Scope Name
72Xen6
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1YeIAIwxZF8HKLDBJLnZIXL7OJklLWSJS2pgzNeFWe4U
Assembly Version
7.3.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::QEMrEc9mwm()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void b6qcjhNHoMQQOCSkP65.KyqDsCNxllCwVL1onRL::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object ogFhAZw5OALgnK0ysQC.AAfa1PwKaO9u5qPFEeE::MktrLMB9Ke
callvirt System.Void Bx6lRXwxuDKV5e0X7YJ.w5hfTJwiYluqtulNttD::eEYYFPgnIm()
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙