Suspicious
Suspect

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 19bbb99253f9b87740ffee39d85eb931
Sha1 c9c2b6fe04f9bf21aad061c5776367b3149d7553
Sha256 3637ca34ceee7b2a404aad80b80ac2e5da7ec008f03d55fa2ad662f5c93378f3
Sha384 c2a16b175a940918c8e60ae8c2cec35e50958eabd55d4217e2c1b657854737445018b3da681753f5e634fca9617c7aa2
Sha512 4cd7737cae50e49e9dd5c5fa97a5426a115e6a706b344bd0dc2c21d6533ea8c2ae85e5acb18fcf0e21a4e5c19eae934bcb33aab4550b3638e5308c3fba80ddd7
SSDeep 49152:vrZuw7rRFirm+Nn42KK8i7Ltwa+VVaSdT:vrZueavNnoK8i7LtwbHJd
TLSH 3F95F110B7F58116F1FF6BB9A8B708450B77B9029A3AC34F598CA09D1FA37409E513A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
19bbb99253f9b87740ffee39d85eb931
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Pulsar.Client.FrmRemoteChat.resources
costura.aforge.dll.compressed
costura.aforge.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.dll.compressed
costura.aforge.video.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.directshow.dll.compressed
costura.aforge.video.directshow.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
costura.gma.system.mousekeyhook.dll.compressed
costura.gma.system.mousekeyhook.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.core.dll.compressed
costura.naudio.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.wasapi.dll.compressed
costura.naudio.wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.winforms.dll.compressed
costura.naudio.winforms.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
costura.naudio.winmm.dll.compressed
costura.naudio.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.protobuf-net.dll.compressed
costura.protobuf-net.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.protobuf-net.core.dll.compressed
costura.protobuf-net.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.dll.compressed
costura.sharpdx.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.pdb.compressed
costura.sharpdx.pdb
costura.sharpdx.d3dcompiler.dll.compressed
costura.sharpdx.d3dcompiler.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.d3dcompiler.pdb.compressed
costura.sharpdx.d3dcompiler.pdb
costura.sharpdx.direct2d1.dll.compressed
costura.sharpdx.direct2d1.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.direct2d1.pdb.compressed
costura.sharpdx.direct2d1.pdb
costura.sharpdx.direct3d11.dll.compressed
costura.sharpdx.direct3d11.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.direct3d11.pdb.compressed
costura.sharpdx.direct3d11.pdb
costura.sharpdx.dxgi.dll.compressed
costura.sharpdx.dxgi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.dxgi.pdb.compressed
costura.sharpdx.dxgi.pdb
costura.sharpdx.mathematics.dll.compressed
costura.sharpdx.mathematics.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.mathematics.pdb.compressed
costura.sharpdx.mathematics.pdb
costura.system.buffers.dll.compressed
costura.system.buffers.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.collections.immutable.dll.compressed
costura.system.collections.immutable.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Collections.Immutable.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
costura.system.memory.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.pulsar.common.dll.compressed
costura.pulsar.common.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.6.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1528
Main Method
System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Main IL Instruction Count
11
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::86GqGMIp8J()
newobj System.Void cyefroqvfomximhrjpcjnvj.SYWMEpSm9Xzc::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.6.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1528
Main Method
System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Main IL Instruction Count
11
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::86GqGMIp8J()
newobj System.Void cyefroqvfomximhrjpcjnvj.SYWMEpSm9Xzc::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
?huhuhuhu
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
?huhuhuhu
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
protohuhuhuhuhuhuhu
PDB Path PATH
protobhuhuhuhuhuhuhu
PDB Path PATH
Shahuhuhuhu
PDB Path PATH
SharpDhuhuhuhuhuhuhu
PDB Path PATH
SharpDhuhuhuhuhuhuhu
PDB Path PATH
SharpDhuhuhuhuhuhuhu
PDB Path PATH
Sharphuhuhuhuhuhuhu
PDB Path PATH
SharpDhuhuhuhuhuhuhu
PDB Path PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
/_/arthuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
D:\a\_huhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
D:\a\_huhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
19bbb99253f9b87740ffee39d85eb931
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Pulsar.Client.FrmRemoteChat.resources
costura.aforge.dll.compressed
costura.aforge.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.dll.compressed
costura.aforge.video.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.directshow.dll.compressed
costura.aforge.video.directshow.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
costura.gma.system.mousekeyhook.dll.compressed
costura.gma.system.mousekeyhook.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.core.dll.compressed
costura.naudio.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.wasapi.dll.compressed
costura.naudio.wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.winforms.dll.compressed
costura.naudio.winforms.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
costura.naudio.winmm.dll.compressed
costura.naudio.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.protobuf-net.dll.compressed
costura.protobuf-net.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.protobuf-net.core.dll.compressed
costura.protobuf-net.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.dll.compressed
costura.sharpdx.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.pdb.compressed
costura.sharpdx.pdb
costura.sharpdx.d3dcompiler.dll.compressed
costura.sharpdx.d3dcompiler.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.d3dcompiler.pdb.compressed
costura.sharpdx.d3dcompiler.pdb
costura.sharpdx.direct2d1.dll.compressed
costura.sharpdx.direct2d1.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.direct2d1.pdb.compressed
costura.sharpdx.direct2d1.pdb
costura.sharpdx.direct3d11.dll.compressed
costura.sharpdx.direct3d11.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.direct3d11.pdb.compressed
costura.sharpdx.direct3d11.pdb
costura.sharpdx.dxgi.dll.compressed
costura.sharpdx.dxgi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.dxgi.pdb.compressed
costura.sharpdx.dxgi.pdb
costura.sharpdx.mathematics.dll.compressed
costura.sharpdx.mathematics.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sharpdx.mathematics.pdb.compressed
costura.sharpdx.mathematics.pdb
costura.system.buffers.dll.compressed
costura.system.buffers.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.collections.immutable.dll.compressed
costura.system.collections.immutable.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Collections.Immutable.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
costura.system.memory.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.pulsar.common.dll.compressed
costura.pulsar.common.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
No malware configuration was found at this point.
PDB Path PATH
?huhuhuhu
19bbb99253f9b87740ffee39d85eb931
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.aforge.dll
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.aforge.video.dll
PDB Path PATH
D:\Andhuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.aforge.video.directshow.dll
PDB Path PATH
?huhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.gma.system.mousekeyhook.dll
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.naudio.core.dll
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.naudio.wasapi.dll
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.naudio.winforms.dll
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.naudio.winmm.dll
PDB Path PATH
protohuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.protobuf-net.dll
PDB Path PATH
protobhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.protobuf-net.core.dll
PDB Path PATH
Shahuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.dll
PDB Path PATH
SharpDhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.d3dcompiler.dll
PDB Path PATH
SharpDhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.direct2d1.dll
PDB Path PATH
SharpDhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.direct3d11.dll
PDB Path PATH
Sharphuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.dxgi.dll
PDB Path PATH
SharpDhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.sharpdx.mathematics.dll
PDB Path PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.system.buffers.dll
PDB Path PATH
/_/arthuhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.system.collections.immutable.dll
PDB Path PATH
D:\a\_huhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.system.memory.dll
PDB Path PATH
E:\A\_huhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.system.numerics.vectors.dll
PDB Path PATH
D:\a\_huhuhuhuhuhuhuhuhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.system.runtime.compilerservices.unsafe.dll
PDB Path PATH
?huhuhuhu
19bbb99253f9b87740ffee39d85eb931 › .Net Resources › costura.pulsar.common.dll
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙