Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 1b7be3e24bef996b5e313aedf478815a
Size: 736.77 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 1b7be3e24bef996b5e313aedf478815a
Sha1 ba4da717a43001f1bc14b204608749dd84d81e3c
Sha256 897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
Sha384 dba9f3701d4d185c649a254373cbfef0e7d98680588a77c33fc97a0af9082bf23cc52974d53fb5f014010f93af6be957
Sha512 6cbb591ed6c04327b496d042e1c16190a9e45a0fccb7d32e21ad5139f63fbc559febb9760a9fbca49c3ab5a1534f101b55c522fc358b1185332936e74be0ca04
SSDeep 12288:8vH4DGHYYNRHYLa9qMhHauEbJ4E4n2uXIIYzcdhaHJOfG:iHyGHYYNRHYm9Ph6WE4n54IwcdhCeG
TLSH AAF4BD0223E69B24F8BF673986B1851087F9FD069236EB5E3B4B11F91F12B558952333
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1b7be3e24bef996b5e313aedf478815a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Cerkagofan.habadegar
A_s0b.Resources.resources
f6e061aea6afe6.Resources.resources
91ade1ff0
[NBF]root.Data
91ade1ff1
[NBF]root.Data
91ade1ff2
[NBF]root.Data
91ade1ff3
[NBF]root.Data
91ade1ff4
[NBF]root.Data
91ade1ff5
[NBF]root.Data
91ade1ff6
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
A_s0b
Full Name
A_s0b
EntryPoint
System.Void A_s0b.Jen9k/Ex4eo0SbCkn.Tkw5b7Bi9mfL::pj9Bw1Ezid6K()
Scope Name
A_s0b
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
A_s0b
Assembly Version
18.16.46.250
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
993
Main Method
System.Void A_s0b.Jen9k/Ex4eo0SbCkn.Tkw5b7Bi9mfL::pj9Bw1Ezid6K()
Main IL Instruction Count
91
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 20
stloc.1 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.2 <null>
ldloc.1 <null>
stloc.s V_7
ldc.i4.1 <null>
stloc.s V_8
br.s IL_002E: ldloc.s V_8
ldloc.2 <null>
ldloc.s V_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_8
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_7
ble.s IL_001F: ldloc.2
ldstr FacilityOptima.Core
stloc.3 <null>
ldstr 2.4.1
stloc.s V_4
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.s 12
callvirt System.String System.String::Substring(System.Int32,System.Int32)
stloc.s V_5
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Int32>::get_Count()
ldloc.1 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_10
ldloc.s V_10
brfalse.s IL_0078: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr FacilityOptima
ldstr Cache
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brfalse.s IL_00AA: nop
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
nop <null>
ldc.i4.s 40
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldstr habadegar
call System.Void A_s0b.pd3H0Mjgc/z_9Bz6W.2qmXs3::mb5A7K(System.String)
nop <null>
call System.Void System.GC::Collect()
nop <null>
call System.Void System.GC::WaitForPendingFinalizers()
nop <null>
leave.s IL_00E0: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E0: nop
nop <null>
ret <null>
Module Name
A_s0b
Full Name
A_s0b
EntryPoint
System.Void A_s0b.Jen9k/Ex4eo0SbCkn.Tkw5b7Bi9mfL::pj9Bw1Ezid6K()
Scope Name
A_s0b
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
A_s0b
Assembly Version
18.16.46.250
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
993
Main Method
System.Void A_s0b.Jen9k/Ex4eo0SbCkn.Tkw5b7Bi9mfL::pj9Bw1Ezid6K()
Main IL Instruction Count
91
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 20
stloc.1 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.2 <null>
ldloc.1 <null>
stloc.s V_7
ldc.i4.1 <null>
stloc.s V_8
br.s IL_002E: ldloc.s V_8
ldloc.2 <null>
ldloc.s V_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_8
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_7
ble.s IL_001F: ldloc.2
ldstr FacilityOptima.Core
stloc.3 <null>
ldstr 2.4.1
stloc.s V_4
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.s 12
callvirt System.String System.String::Substring(System.Int32,System.Int32)
stloc.s V_5
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Int32>::get_Count()
ldloc.1 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_10
ldloc.s V_10
brfalse.s IL_0078: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr FacilityOptima
ldstr Cache
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brfalse.s IL_00AA: nop
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
nop <null>
ldc.i4.s 40
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldstr habadegar
call System.Void A_s0b.pd3H0Mjgc/z_9Bz6W.2qmXs3::mb5A7K(System.String)
nop <null>
call System.Void System.GC::Collect()
nop <null>
call System.Void System.GC::WaitForPendingFinalizers()
nop <null>
leave.s IL_00E0: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E0: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙