18686e645e31259ec533b256f7982f1b

PE Executable

MD5: 18686e645e31259ec533b256f7982f1b

Size: 7.6 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	18686e645e31259ec533b256f7982f1b
Sha1	9d59ffe337070af5aa77fd5689c0f3d894831044
Sha256	0714af49edc930cea4e4d0345090d71f04ce97093bd487a9ce36e1b18d27f8d2
Sha384	5aba44b4bf69e140bc0ca4d0846237cb28a23a914902153702f657b2e9677c7cbbdf7085eea75d0a1fd6523ac4398cf1
Sha512	4378babf5c694c3ce4c93c2f5fa77a33e21443bb325a2895a01db6eba746f70fa915acab2f8310779e709612933a2b86ad9b8a8b1d4b80f709e9d4f635be25e6
SSDeep	98304:/sSqwhWRGpUCIkFGDNHxiPsBJAjxJQbbMzr/:/shiWqukF2NHAPsPAjxJmbMzr
TLSH	C6763303BDA28835F63DEDB29D650B26373753C13C619187442CDA71EAF404E962BE9B

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_55c59dff.bin (4011008 bytes)
Module Name	Loader.exe
Full Name	Loader.exe
EntryPoint	System.Void Program::Main()
Scope Name	Loader.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Loader
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	17
Main Method	System.Void Program::Main()
Main IL Instruction Count	40
Main IL	ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007A: ldnull nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_0078: br.s IL_0081 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0022: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0078: br.s IL_0081 br.s IL_0081: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.