Suspicious
Suspect

19447dd51d52b27e5918d50d6782655a

PE Executable
MD5: 19447dd51d52b27e5918d50d6782655a
Size: 1.25 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 19447dd51d52b27e5918d50d6782655a
Sha1 8fe4eb8b899a696fbb88f56094dc25e876da2a66
Sha256 17b4070f7739accf08ec200d8fe71a65f407afbca9f3f576f42397519f694d2d
Sha384 947df72364d5a84fc07b01ff1cc68b0a7a286ca85de44816d650455c0bf3a26d035e947b9dc0efb031c8e5d030b2a246
Sha512 54372fd500290b8a4a4b38670a2476734a75770ba58f69907a4d71725f78c39d141fad16765cd54cde7c4b39da1c92a0d98fb02427b73f3cab4b566b9081432e
SSDeep 24576:I9OYpR9q2iB0l+X2jWwwTpIsQ18NSaJKOczu0wrym5:I9OSy08nwwTp0uApOb0wum
TLSH AF45CF9C3202FA6FC403A971C975DDF466106CA6D606C22794D73DBBBF3D9A68E041E2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
19447dd51d52b27e5918d50d6782655a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
AvalancheSlope.FormWetter.resources
AvalancheSlope.FormSchneedecke.resources
$this.Icon
[NBF]root.IconData
AvalancheSlope.Properties.Resources.resources
Kare
[NBF]root.Data
cBVS
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
GPhX.exe
Full Name
GPhX.exe
EntryPoint
System.Void AvalancheSlope.Program::Main()
Scope Name
GPhX.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GPhX
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
0
Main Method
System.Void AvalancheSlope.Program::Main()
Main IL Instruction Count
52
Main IL 
nop <null>
ldc.i4 -1366524244
ldc.i4 -1465343963
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.7 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00A3: ret
newobj System.Void AvalancheSlope.SchneeDataSet::.ctor()
stloc.0 <null>
ldloc.1 <null>
ldc.i4 -1551906186
mul <null>
ldc.i4 -1332467797
xor <null>
br.s IL_0006: ldc.i4 -1465343963
nop <null>
ldc.i4.0 <null>
call System.Void AvalancheSlope.Program::‌‏‬‎‮‮‌‬‭‎‌‮‎‍‏‏‪‬​‮‌‫‮(System.Boolean)
nop <null>
ldloc.1 <null>
ldc.i4 -236287651
mul <null>
ldc.i4 -1078628031
xor <null>
br.s IL_0006: ldc.i4 -1465343963
ldloc.0 <null>
newobj System.Void AvalancheSlope.FormHang::.ctor(AvalancheSlope.SchneeDataSet)
call System.Void AvalancheSlope.Program::‍‬‫‬‫‫‍‫‫‬‏‮‫‪​‬‬‏‭‬‬‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -355569899
mul <null>
ldc.i4 -1457989812
xor <null>
br.s IL_0006: ldc.i4 -1465343963
nop <null>
ldloc.1 <null>
ldc.i4 -1610699704
mul <null>
ldc.i4 -1396185630
xor <null>
br IL_0006: ldc.i4 -1465343963
call System.Void AvalancheSlope.Program::‎‎‎‍‏‬‍‌​​‪‬‭​‌‍‬‌‏‮()
ldloc.1 <null>
ldc.i4 -1811844106
mul <null>
ldc.i4 1840872036
xor <null>
br IL_0006: ldc.i4 -1465343963
ret <null>
Module Name
GPhX.exe
Full Name
GPhX.exe
EntryPoint
System.Void AvalancheSlope.Program::Main()
Scope Name
GPhX.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GPhX
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void AvalancheSlope.Program::Main()
Main IL Instruction Count
52
Main IL 
nop <null>
ldc.i4 -1366524244
ldc.i4 -1465343963
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.7 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00A3: ret
newobj System.Void AvalancheSlope.SchneeDataSet::.ctor()
stloc.0 <null>
ldloc.1 <null>
ldc.i4 -1551906186
mul <null>
ldc.i4 -1332467797
xor <null>
br.s IL_0006: ldc.i4 -1465343963
nop <null>
ldc.i4.0 <null>
call System.Void AvalancheSlope.Program::‌‏‬‎‮‮‌‬‭‎‌‮‎‍‏‏‪‬​‮‌‫‮(System.Boolean)
nop <null>
ldloc.1 <null>
ldc.i4 -236287651
mul <null>
ldc.i4 -1078628031
xor <null>
br.s IL_0006: ldc.i4 -1465343963
ldloc.0 <null>
newobj System.Void AvalancheSlope.FormHang::.ctor(AvalancheSlope.SchneeDataSet)
call System.Void AvalancheSlope.Program::‍‬‫‬‫‫‍‫‫‬‏‮‫‪​‬‬‏‭‬‬‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -355569899
mul <null>
ldc.i4 -1457989812
xor <null>
br.s IL_0006: ldc.i4 -1465343963
nop <null>
ldloc.1 <null>
ldc.i4 -1610699704
mul <null>
ldc.i4 -1396185630
xor <null>
br IL_0006: ldc.i4 -1465343963
call System.Void AvalancheSlope.Program::‎‎‎‍‏‬‍‌​​‪‬‭​‌‍‬‌‏‮()
ldloc.1 <null>
ldc.i4 -1811844106
mul <null>
ldc.i4 1840872036
xor <null>
br IL_0006: ldc.i4 -1465343963
ret <null>
19447dd51d52b27e5918d50d6782655a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
AvalancheSlope.FormWetter.resources
AvalancheSlope.FormSchneedecke.resources
$this.Icon
[NBF]root.IconData
AvalancheSlope.Properties.Resources.resources
Kare
[NBF]root.Data
cBVS
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙