Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 19125edc1d7688ba984abfeccf34b93e
Size: 1.36 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 19125edc1d7688ba984abfeccf34b93e
Sha1 bc1a40df5d28d274bd6d1dfaf1dacea5391ef0c2
Sha256 691939843feb83cbbeb6802fccb8d7ac8e6cbd7f7c676e5a9eb549353691db88
Sha384 ac08285fcf073d703b4421f3d9b9a762060c54f86000941dadac3dc0b3edbc282e68f1b9997511ecd67db2155df4d541
Sha512 4f45cdef3faee579c1b97fb265da04bacd1f54b5102127c507cd2be3218b49fc54704efb324489cc5df15ff251a7231db3f330ff783970d8a371843404897e48
SSDeep 24576:INF1icYGpoDcMCnRveYepqMKDmfC4KOSSn2c6G:OF181DgRveYkqM3fC41p2e
TLSH 1455BFE51EE43B51D17EFF314B7A0A7063FD79578E21CB89304723E69E2270698806E6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
19125edc1d7688ba984abfeccf34b93e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FiberaDigit.fibraship.ico
pw1ZQ6gzfA5fC.pd7EY.resources
$this.Icon
[NBF]root.IconData
AboutDeveloperToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
AboutSoftwareToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
ExitToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
SettingsToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pw1ZQ6gzfA5fC.Resources.resources
3684a7c2197a59.Resources.resources
9c4682390
[NBF]root.Data
9c4682391
[NBF]root.Data
9c46823910
[NBF]root.Data
9c46823911
[NBF]root.Data
9c46823912
[NBF]root.Data
9c46823913
[NBF]root.Data
9c46823914
[NBF]root.Data
9c46823915
[NBF]root.Data
9c46823916
[NBF]root.Data
9c46823917
[NBF]root.Data
9c46823918
[NBF]root.Data
9c46823919
[NBF]root.Data
9c4682392
[NBF]root.Data
9c46823920
[NBF]root.Data
9c46823921
[NBF]root.Data
9c46823922
[NBF]root.Data
9c46823923
[NBF]root.Data
9c46823924
[NBF]root.Data
9c46823925
[NBF]root.Data
9c46823926
[NBF]root.Data
9c46823927
[NBF]root.Data
9c46823928
[NBF]root.Data
9c46823929
[NBF]root.Data
9c4682393
[NBF]root.Data
9c46823930
[NBF]root.Data
9c46823931
[NBF]root.Data
9c46823932
[NBF]root.Data
9c46823933
[NBF]root.Data
9c46823934
[NBF]root.Data
9c46823935
[NBF]root.Data
9c46823936
[NBF]root.Data
9c46823937
[NBF]root.Data
9c46823938
[NBF]root.Data
9c46823939
[NBF]root.Data
9c4682394
[NBF]root.Data
9c46823940
[NBF]root.Data
9c46823941
[NBF]root.Data
9c4682395
[NBF]root.Data
9c4682396
[NBF]root.Data
9c4682397
[NBF]root.Data
9c4682398
[NBF]root.Data
9c4682399
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
pw1ZQ6gzfA5fC
Full Name
pw1ZQ6gzfA5fC
EntryPoint
System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::bAn7Zt4kicM()
Scope Name
pw1ZQ6gzfA5fC
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
pw1ZQ6gzfA5fC
Assembly Version
18.11.14.201
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2241
Main Method
System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::bAn7Zt4kicM()
Main IL Instruction Count
73
Main IL 
nop <null>
ldtoken System.Windows.Forms.Application
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.0 <null>
ldloc.0 <null>
ldstr EnableVisualStyles
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldloc.0 <null>
ldstr SetCompatibleTextRenderingDefault
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Boolean
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0071: nop
call System.Boolean pw1ZQ6gzfA5fC.jXx2q6Cs::Zo2ksXk1Yr4n8()
pop <null>
nop <null>
nop <null>
call System.Boolean pw1ZQ6gzfA5fC.jXx2q6Cs::sA_4Dd()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0080: nop
br.s IL_00B6: ret
nop <null>
nop <null>
call System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::kSr5n6M()
nop <null>
leave.s IL_00AF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::8z_Js6Sx9(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
Module Name
pw1ZQ6gzfA5fC
Full Name
pw1ZQ6gzfA5fC
EntryPoint
System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::bAn7Zt4kicM()
Scope Name
pw1ZQ6gzfA5fC
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
pw1ZQ6gzfA5fC
Assembly Version
18.11.14.201
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2241
Main Method
System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::bAn7Zt4kicM()
Main IL Instruction Count
73
Main IL 
nop <null>
ldtoken System.Windows.Forms.Application
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.0 <null>
ldloc.0 <null>
ldstr EnableVisualStyles
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldloc.0 <null>
ldstr SetCompatibleTextRenderingDefault
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Boolean
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0071: nop
call System.Boolean pw1ZQ6gzfA5fC.jXx2q6Cs::Zo2ksXk1Yr4n8()
pop <null>
nop <null>
nop <null>
call System.Boolean pw1ZQ6gzfA5fC.jXx2q6Cs::sA_4Dd()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0080: nop
br.s IL_00B6: ret
nop <null>
nop <null>
call System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::kSr5n6M()
nop <null>
leave.s IL_00AF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void pw1ZQ6gzfA5fC.jXx2q6Cs::8z_Js6Sx9(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙