Deep Malware Analysis of 1dd9ba180ae68bd21afe00e7997d7c6c | md5: 1dd9ba180ae68bd21afe00e7997d7c6c | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.13

PE Executable

MD5: 1dd9ba180ae68bd21afe00e7997d7c6c

Size: 801.79 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	1dd9ba180ae68bd21afe00e7997d7c6c
Sha1	ae6bda8aa4c8bcbd6c15629e3ef0a8d85f3e5949
Sha256	6efe9fbfc3d3e47786a8ae76434966a1c64f7c4e91d8709c4eb36ae7b6bb0a86
Sha384	0d8103154ad2b9592817d692273783660e2cf8b800c503d74f0f82f7886d95bf37d2b46abbc4266369592c2fde74c93c
Sha512	06c9e7f98d165840a5d64204ab070c1f8055ee8a62f021f15934848729d79e8b853c4ce5c3376fffe17deb2240b6c9e013ff9dbafe80c7d751d3887bc084ccec
SSDeep	12288:jany0UxReTM5NJOx+g+K6eg6O+FQJZD1/oxpZDJfywWvzZXa4QY+rso1:4y0U6o5zqiK6eI+6B1wjw
TLSH	6A05CFAD3214B5DFC8A7C1B28A64DD75A6616DAB53178207D0E708EFB90CA87DF140F2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Name	Value
Module Name	Wzzm.exe
Full Name	Wzzm.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	Wzzm.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wzzm
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::‬‍⁮‌‪⁫‏‫⁭⁭‬⁯⁮‪‌‫⁬‎‌‎⁬‪‫⁬⁮‌⁯‎⁫⁫‌‭⁪⁬‭⁯‍‮‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::⁬‮‎‮⁯‎⁮‫⁫⁫⁪⁪‍⁮‭⁫⁮⁯⁪⁭‍⁬‎⁫‏‭‍‮⁫‫⁯‮‭⁮‍⁫‬‪‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::⁬‎⁬‭‮‫⁬‍‍⁬⁯‎‎⁪‪⁪‍⁮‭⁭‌‎‬⁪‏⁬‌⁭‬⁬‎‎⁭⁫‎‮(System.Windows.Forms.Form) ret <null>
Module Name	Wzzm.exe
Full Name	Wzzm.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	Wzzm.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wzzm
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::‬‍⁮‌‪⁫‏‫⁭⁭‬⁯⁮‪‌‫⁬‎‌‎⁬‪‫⁬⁮‌⁯‎⁫⁫‌‭⁪⁬‭⁯‍‮‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::⁬‮‎‮⁯‎⁮‫⁫⁫⁪⁪‍⁮‭⁫⁮⁯⁪⁭‍⁬‎⁫‏‭‍‮⁫‫⁯‮‭⁮‍⁫‬‪‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::⁬‎⁬‭‮‫⁬‍‍⁬⁯‎‎⁪‪⁪‍⁮‭⁭‌‎‬⁪‏⁬‌⁭‬⁬‎‎⁭⁫‎‮(System.Windows.Forms.Form) ret <null>

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

1dd9ba180ae68bd21afe00e7997d7c6c

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

1dd9ba180ae68bd21afe00e7997d7c6c

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.