Suspicious
Suspect

1073c20c06b4a9a1bedced0afff46058

PE Executable
MD5: 1073c20c06b4a9a1bedced0afff46058
Size: 433.66 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1073c20c06b4a9a1bedced0afff46058
Sha1 663b81e5d344d68c0d028193e947c3e1a1b81b5a
Sha256 dfdd4cdf6dd89b4c50a2ad96be9f2aa4c6e1c08ae50eb1de8169827555b0ef89
Sha384 2322bac03ff8384f1389b5e841231df0cd31290a7cbe7b4877c64c4b9204a639ee67f6780932581152e3a770b51c3284
Sha512 4abafff79b45c74e73fe33df4a5202aa5fd8ec9be8f0f53396fb7441d2dccec25a415b1f76e05affd7022a092a620c179b1ee1a6ee168fc1839aace077636663
SSDeep 6144:rR76amUMYsqooXDvngI9WzeGReGrWzLaW6gM/d:rRua+YnpTYI9WyzLv6g8
TLSH C79439A29F5B6E18E5D1A3F8A2253AD4E896BE351BF5D1FCAC2074145B3D361F0CE011
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1073c20c06b4a9a1bedced0afff46058
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: d:\ProjectMain\AutoCryptor\AutoCryptor\bin\Release\net8.0\GeneratedProject_c68acfe2\obj\x86\Release\HL7l8qUj0f.pdb
Module Name
HL7l8qUj0f.exe
Full Name
HL7l8qUj0f.exe
EntryPoint
System.Void PmJyv7gKoV.Program::Main(System.String[])
Scope Name
HL7l8qUj0f.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HL7l8qUj0f
Assembly Version
6.4.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
6
Main Method
System.Void PmJyv7gKoV.Program::Main(System.String[])
Main IL Instruction Count
50
Main IL 
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4 3000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean PmJyv7gKoV.Program::CheckRegion()
brtrue.s IL_002E: ldc.i4 1000
ldstr Region check failed
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Byte[] PmJyv7gKoV.Program::PYoJKWOCHiw51F()
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0046: ldstr "Decryption failed"
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_0052: call System.String System.IO.Path::GetTempPath()
ldstr Decryption failed
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_4
ldloca.s V_4
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .exe
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_00A3: ret
stloc.3 <null>
ldstr Error: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
ret <null>
Module Name
HL7l8qUj0f.exe
Full Name
HL7l8qUj0f.exe
EntryPoint
System.Void PmJyv7gKoV.Program::Main(System.String[])
Scope Name
HL7l8qUj0f.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HL7l8qUj0f
Assembly Version
6.4.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
6
Main Method
System.Void PmJyv7gKoV.Program::Main(System.String[])
Main IL Instruction Count
50
Main IL 
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4 3000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean PmJyv7gKoV.Program::CheckRegion()
brtrue.s IL_002E: ldc.i4 1000
ldstr Region check failed
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Byte[] PmJyv7gKoV.Program::PYoJKWOCHiw51F()
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0046: ldstr "Decryption failed"
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_0052: call System.String System.IO.Path::GetTempPath()
ldstr Decryption failed
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_4
ldloca.s V_4
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .exe
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_00A3: ret
stloc.3 <null>
ldstr Error: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_00A3: ret
ret <null>
1073c20c06b4a9a1bedced0afff46058
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙