Suspicious
Suspect

1351e8e7bb03c7546fdb3f8b2c46ab96

PE Executable
MD5: 1351e8e7bb03c7546fdb3f8b2c46ab96
Size: 901.12 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 1351e8e7bb03c7546fdb3f8b2c46ab96
Sha1 83c5267cd046e6196095822a05b1f5a87241a452
Sha256 c66f94f6f054c6ca06e6561aed88fe54d1ea76bfeb8b5cd8a97c71590f08b063
Sha384 26230cb31d7c226b7a6d0df3d81f3bac9f9046c4f552533a0f2745ed34b762477bb5b5c61b7a07a9935a5a1848fd6164
Sha512 29f73577e6a3d119b92bfb7bb93f2755031b4e398750ef533d4c0865f2faa08d9261195dd195529fcfa62a2c8323c3f004d034b178bfae9015399b4881bde245
SSDeep 24576:mFjErQWEdrrGIszBTJpnZUgjk1vZW1aHkPd6Z2K8ji7n:DK2IszBTJp7jky1wkPd68
TLSH CC15BE1913F41B95F5BEEF3D9834101987FDB802D73AEA5F7D5890E90922B81CA52B23
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1351e8e7bb03c7546fdb3f8b2c46ab96
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Dadekalina.yenome1uakx89
Jba0wd2N.Resources.resources
d0b934029e558c.Resources.resources
8213a5c90
[NBF]root.Data
8213a5c91
[NBF]root.Data
8213a5c92
[NBF]root.Data
8213a5c93
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Jba0wd2N
Full Name
Jba0wd2N
EntryPoint
System.Void Jba0wd2N.3zyYsBe::Tk3ew1CcYmm9sS()
Scope Name
Jba0wd2N
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jba0wd2N
Assembly Version
23.20.4.296
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1779
Main Method
System.Void Jba0wd2N.3zyYsBe::Tk3ew1CcYmm9sS()
Main IL Instruction Count
50
Main IL 
nop <null>
ldc.i4 5000
ldc.i4 5000
call System.Void Jba0wd2N.3zyYsBe::tn8M4Yz(System.Int32,System.Int32)
nop <null>
nop <null>
newobj System.Void Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldstr yenome1uakx89
stfld System.String Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::8SymwxD9i
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldloc.1 <null>
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
ldloc.0 <null>
ldftn System.Boolean Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::is7TL3eo(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
call System.String[] System.Array::FindAll<System.String>(System.String[],System.Predicate`1<System.String>)
stloc.2 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor(System.Int32)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
ldloc.2 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Object>::AddRange(System.Collections.Generic.IEnumerable`1<System.Object>)
nop <null>
ldc.i4 1048576
call System.Void Jba0wd2N.3zyYsBe::cPe5Sd(System.Int32)
nop <null>
ldloc.3 <null>
call System.Void Jba0wd2N.3zyYsBe/8pyQA9jp2dc.yQe3Mw5qq9cDnW::Jr7pdRm0n5T(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0080: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0080: nop
nop <null>
ret <null>
Module Name
Jba0wd2N
Full Name
Jba0wd2N
EntryPoint
System.Void Jba0wd2N.3zyYsBe::Tk3ew1CcYmm9sS()
Scope Name
Jba0wd2N
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jba0wd2N
Assembly Version
23.20.4.296
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1779
Main Method
System.Void Jba0wd2N.3zyYsBe::Tk3ew1CcYmm9sS()
Main IL Instruction Count
50
Main IL 
nop <null>
ldc.i4 5000
ldc.i4 5000
call System.Void Jba0wd2N.3zyYsBe::tn8M4Yz(System.Int32,System.Int32)
nop <null>
nop <null>
newobj System.Void Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldstr yenome1uakx89
stfld System.String Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::8SymwxD9i
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldloc.1 <null>
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
ldloc.0 <null>
ldftn System.Boolean Jba0wd2N.3zyYsBe/6Hm_Jbt.Jdj76Ti::is7TL3eo(System.String)
newobj System.Void System.Predicate`1<System.String>::.ctor(System.Object,System.IntPtr)
call System.String[] System.Array::FindAll<System.String>(System.String[],System.Predicate`1<System.String>)
stloc.2 <null>
ldloc.2 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor(System.Int32)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
ldloc.2 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Object>::AddRange(System.Collections.Generic.IEnumerable`1<System.Object>)
nop <null>
ldc.i4 1048576
call System.Void Jba0wd2N.3zyYsBe::cPe5Sd(System.Int32)
nop <null>
ldloc.3 <null>
call System.Void Jba0wd2N.3zyYsBe/8pyQA9jp2dc.yQe3Mw5qq9cDnW::Jr7pdRm0n5T(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0080: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0080: nop
nop <null>
ret <null>
1351e8e7bb03c7546fdb3f8b2c46ab96
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Dadekalina.yenome1uakx89
Jba0wd2N.Resources.resources
d0b934029e558c.Resources.resources
8213a5c90
[NBF]root.Data
8213a5c91
[NBF]root.Data
8213a5c92
[NBF]root.Data
8213a5c93
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙