Suspicious
Suspect

15d28d022a2417bf6e50030305ec6141

PE Executable
MD5: 15d28d022a2417bf6e50030305ec6141
Size: 4.61 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 15d28d022a2417bf6e50030305ec6141
Sha1 dc0e2d5cc6ed9524cef57de4e7183840b83b46b3
Sha256 7969ccaf1db750bc3b02d51626d6916ecbd0c0cf2f7de3c7bc0be240f5f2978d
Sha384 6b0af4c9e848de188efb20f5e657338410a29ee7f55f918fdb23a8991cab61b21a097de5367225d9a255ca2b1469a5db
Sha512 a68f19bf922e2570c2f6e3a12061d66fd77df7dd2f6c1ccf6244b996c3cb80e4937aa8ba39af89826ce537e1f8c1b2c24f3c64a2b58745005ffd905eb553b6a9
SSDeep 48:62itA1D3pdnJFtnJLHGJ7tM7N1YmT5kY4e8EOulBL4qXSfbNtm:f1z3JjnJLHwtibY42JKzLQzNt
TLSH 05919652E3E885AEF0AB877159F383002775F7565E578B5F2CC8121EAD227544E137B0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
15d28d022a2417bf6e50030305ec6141
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
CaptureScreen.exe
Full Name
CaptureScreen.exe
EntryPoint
System.Int32 CaptureScreen::Main(System.String[])
Scope Name
CaptureScreen.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CaptureScreen
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Int32 CaptureScreen::Main(System.String[])
Main IL Instruction Count
94
Main IL 
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0029: nop
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldstr Usage: CaptureScreen.exe <output.png>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.1 <null>
stloc.s V_4
br IL_00C8: nop
nop <null>
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.0 <null>
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Width()
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Height()
newobj System.Void System.Drawing.Bitmap::.ctor(System.Int32,System.Int32)
stloc.1 <null>
nop <null>
ldloc.1 <null>
call System.Drawing.Graphics System.Drawing.Graphics::FromImage(System.Drawing.Image)
stloc.2 <null>
nop <null>
ldloc.2 <null>
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Left()
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Top()
ldc.i4.0 <null>
ldc.i4.0 <null>
ldloca.s V_0
call System.Drawing.Size System.Drawing.Rectangle::get_Size()
ldc.i4 13369376
callvirt System.Void System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation)
nop <null>
nop <null>
leave.s IL_0085: nop
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0084: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldloc.1 <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.Drawing.Imaging.ImageFormat System.Drawing.Imaging.ImageFormat::get_Png()
callvirt System.Void System.Drawing.Image::Save(System.String,System.Drawing.Imaging.ImageFormat)
nop <null>
nop <null>
leave.s IL_00AA: nop
ldloc.1 <null>
ldnull <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_00A9: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_4
leave.s IL_00C8: nop
stloc.3 <null>
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.2 <null>
stloc.s V_4
leave.s IL_00C8: nop
nop <null>
ldloc.s V_4
ret <null>
Module Name
CaptureScreen.exe
Full Name
CaptureScreen.exe
EntryPoint
System.Int32 CaptureScreen::Main(System.String[])
Scope Name
CaptureScreen.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CaptureScreen
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Int32 CaptureScreen::Main(System.String[])
Main IL Instruction Count
94
Main IL 
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0029: nop
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldstr Usage: CaptureScreen.exe <output.png>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.1 <null>
stloc.s V_4
br IL_00C8: nop
nop <null>
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.0 <null>
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Width()
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Height()
newobj System.Void System.Drawing.Bitmap::.ctor(System.Int32,System.Int32)
stloc.1 <null>
nop <null>
ldloc.1 <null>
call System.Drawing.Graphics System.Drawing.Graphics::FromImage(System.Drawing.Image)
stloc.2 <null>
nop <null>
ldloc.2 <null>
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Left()
ldloca.s V_0
call System.Int32 System.Drawing.Rectangle::get_Top()
ldc.i4.0 <null>
ldc.i4.0 <null>
ldloca.s V_0
call System.Drawing.Size System.Drawing.Rectangle::get_Size()
ldc.i4 13369376
callvirt System.Void System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation)
nop <null>
nop <null>
leave.s IL_0085: nop
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0084: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldloc.1 <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.Drawing.Imaging.ImageFormat System.Drawing.Imaging.ImageFormat::get_Png()
callvirt System.Void System.Drawing.Image::Save(System.String,System.Drawing.Imaging.ImageFormat)
nop <null>
nop <null>
leave.s IL_00AA: nop
ldloc.1 <null>
ldnull <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_00A9: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_4
leave.s IL_00C8: nop
stloc.3 <null>
nop <null>
call System.IO.TextWriter System.Console::get_Error()
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
nop <null>
ldc.i4.2 <null>
stloc.s V_4
leave.s IL_00C8: nop
nop <null>
ldloc.s V_4
ret <null>
15d28d022a2417bf6e50030305ec6141
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙