Deep Malware Analysis of 1b5dc2b008c0fd93c71bcd9a5e2397a3 | md5: 1b5dc2b008c0fd93c71bcd9a5e2397a3 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.09

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	1b5dc2b008c0fd93c71bcd9a5e2397a3
Sha1	6d36baa29fdaaecc465d6d599666af5cf379dde3
Sha256	620a2b5ff17f78cc2aeeb9be6c3df19a085aee5db2f81c0ab7bbedac0d12f530
Sha384	e0f4142403e853e9dcc47d1dd323f01095c1930bc0e8e3e86ca73545095647c4f0c724e6f9aa5ac76b1232506fbefc3f
Sha512	afdb8ae14e625bb8daee524c5ba097ec29294cd64a6b7dd8b12aae269b77095d374401d60aa4c24dbf3464c93e81bdcdfda9a403c320a20b2dc68ab03fda78ae
SSDeep	24576:3bgyWLgqAm84omdua23byWc3o2yeH3Igkg8xzIjgr9K7OuE+PUkQCtK:rgyWLg884opa2+82j3IgmFImr5IUkQCt
TLSH	7C55F1117250CD9BCD3D49F60613C17063FA8E5FA12CD2C9ADD579EB3AF1B942821A93

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	PIsE.exe
Full Name	PIsE.exe
EntryPoint	System.Void PharmacyProject.Program::Main()
Scope Name	PIsE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	PIsE
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1139
Main Method	System.Void PharmacyProject.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void PharmacyProject.FrmAnaGiris::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`
Module Name	PIsE.exe
Full Name	PIsE.exe
EntryPoint	System.Void PharmacyProject.Program::Main()
Scope Name	PIsE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	PIsE
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1139
Main Method	System.Void PharmacyProject.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void PharmacyProject.FrmAnaGiris::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`

PDB Path PATH

PIhuhuhuhu

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential