Suspicious
Suspect

227f18692929b5441b4af3c8e3cb1b8d

Share on LinkedIn
Print
PE Executable
MD5: 227f18692929b5441b4af3c8e3cb1b8d
Size: 17.37 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 227f18692929b5441b4af3c8e3cb1b8d
Sha1 f1f9cab1210ae1d49a150c625f212b787213026c
Sha256 d4b9c899268f2ce39c69b8ae0c454d320f0c38eec49fa1ee8e9aaca6fe7b2f8a
Sha384 84f912ee7f7de1efd4408bbc2d8ba916b856d1052bbb47db40890c7e8e0c57e84adc3c46a780020b33807aa7885e48a5
Sha512 3b8c0e306eca74d97ef0e5ccf873f34d55f2585f4f690a22eb6fe31979f6ca71bf95ca88d7b908adbd6d9e1175d238ad1ce0b65fb5a181b24b8d96a44216349f
SSDeep 3072:0LehWQuIwB/rsfvGWz++hxSzDSx9MHSWtGLHVr3mJLMHQwgDyun7gtwGbebkA6Ko:rklhWphxSCxmyWQpr3e4MDyuGpby6t
TLSH 1F075C0B7FD5D659E9A53B7BC6FB090007B2B5D24131E3092B0996F64D81233BE1A3AD
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
227f18692929b5441b4af3c8e3cb1b8d
Overlay_0758363e.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yjv2wcaq6qdhgvd3lt6o329
e4yl33z32b6xqhy4tpbf1zra
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_0758363e.bin (17098752 bytes)
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void SocialApp.SummaryJournal::PodcastConverter(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
710
Main Method
System.Void SocialApp.SummaryJournal::PodcastConverter(System.String[])
Main IL Instruction Count
173
Main IL 
ldc.i4 3486
stloc V_3
br IL_003F: br IL_000E
nop <null>
ldloc V_3
ldc.i4 3486
ceq <null>
brfalse IL_0029: nop
nop <null>
ldc.i4 3497
stloc V_3
nop <null>
ldloc V_3
ldc.i4 3497
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: call System.Void SocialApp.YogaManager::CookingAppointment()
br IL_000E: nop
call System.Void SocialApp.YogaManager::CookingAppointment()
call System.Void SocialApp.HabitApp::FamilyBooster()
ldsfld System.String SocialApp.YogaManager::MealPrepManager
call System.String SocialApp.CyclingTracker::WaterLog()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_006C: ldsfld System.String SocialApp.YogaManager::ContractLogger
call System.Void MeditationTracker.MindCalculator::ReporterDiary()
ldsfld System.String SocialApp.YogaManager::ContractLogger
call System.Boolean SocialInventory.TaskFinance::WeatherManager(System.String)
brtrue IL_0080: call System.Void SocialInventory.ConverterTool::SymptomConverter()
leave IL_029D: ret
call System.Void SocialInventory.ConverterTool::SymptomConverter()
call System.Void GlucoseApp.ConverterTimer::PersonalTool()
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldfld System.Boolean SocialApp.ReporterScheduler::PlannerSaver
brtrue IL_027F: ldc.i4 200
ldsfld System.String SocialApp.YogaManager::TaxMonitor
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_0
ldloc V_0
ldsfld System.Random GlucoseApp.ConverterTimer::StudyAnalyzer
ldloc V_0
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem System.String
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_1
ldloc V_1
ldc.i4 1
ldelem System.String
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_2
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
callvirt System.Void SocialApp.ReporterScheduler::AnalyzerAnalyzer()
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldloc V_1
ldc.i4 0
ldelem System.String
ldloc V_2
ldsfld System.Random GlucoseApp.ConverterTimer::StudyAnalyzer
ldloc V_2
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem System.String
callvirt System.Void SocialApp.ReporterScheduler::ClassPlanner(System.String,System.String)
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldfld System.Boolean SocialApp.ReporterScheduler::PlannerSaver
brfalse IL_027F: ldc.i4 200
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
newobj System.Void GlucoseApp.YogaTracker::.ctor(SocialApp.ReporterScheduler)
stfld GlucoseApp.YogaTracker SocialApp.ReporterScheduler::MealPrepTracker
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
newobj System.Void GlucoseApp.TherapyMonitor::.ctor(SocialApp.ReporterScheduler)
stfld GlucoseApp.TherapyMonitor SocialApp.ReporterScheduler::WeightManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldc.i4 15
newarr System.Object
dup <null>
ldc.i4 0
call System.String SocialApp.CyclingTracker::ChoreDiary()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
stelem.ref <null>
dup <null>
ldc.i4 1
call System.Byte[] GlucoseApp.ConverterTimer::FitnessCalculator()
stelem.ref <null>
dup <null>
ldc.i4 2
ldsfld System.String SocialApp.YogaManager::VaultTracker
stelem.ref <null>
dup <null>
ldc.i4 3
ldsfld System.String SocialApp.YogaManager::ReminderTimer
stelem.ref <null>
dup <null>
ldc.i4 4
call System.String System.Environment::get_UserName()
call System.String SocialApp.CyclingTracker::WorkoutManager()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4 5
ldsfld System.String SocialApp.YogaManager::HomeTracker
stelem.ref <null>
dup <null>
ldc.i4 6
ldsfld System.String SocialApp.YogaManager::WeightCalculator
stelem.ref <null>
dup <null>
ldc.i4 7
ldsfld System.String SocialApp.YogaManager::AppTracker
stelem.ref <null>
dup <null>
ldc.i4 8
ldsfld System.String SocialApp.YogaManager::SymptomApp
stelem.ref <null>
dup <null>
ldc.i4 9
ldsfld System.String SocialApp.YogaManager::DietLogger
stelem.ref <null>
dup <null>
ldc.i4 10
ldsfld System.String SocialApp.YogaManager::PlannerTranslator
stelem.ref <null>
dup <null>
ldc.i4 11
ldsfld System.String SocialApp.YogaManager::ConverterMonitor
stelem.ref <null>
dup <null>
ldc.i4 12
ldsfld System.String SocialApp.YogaManager::FoodTracker
stelem.ref <null>
dup <null>
ldc.i4 13
call System.Int32 GlucoseApp.ConverterTimer::DietGenerator()
box System.Int32
stelem.ref <null>
dup <null>
ldc.i4 14
call System.String GlucoseApp.ConverterTimer::SmartCreator()
stelem.ref <null>
call System.Byte[] GlucoseApp.MindAnalyzer::YogaSecurity(System.Object[])
callvirt System.Void SocialApp.ReporterScheduler::PrescriptionInventory(System.Byte[])
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_008A: ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
callvirt System.String System.Object::ToString()
call System.Void System.Console::WriteLine(System.String)
leave IL_029D: ret
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void SocialApp.SummaryJournal::PodcastConverter(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
710
Main Method
System.Void SocialApp.SummaryJournal::PodcastConverter(System.String[])
Main IL Instruction Count
173
Main IL 
ldc.i4 3486
stloc V_3
br IL_003F: br IL_000E
nop <null>
ldloc V_3
ldc.i4 3486
ceq <null>
brfalse IL_0029: nop
nop <null>
ldc.i4 3497
stloc V_3
nop <null>
ldloc V_3
ldc.i4 3497
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: call System.Void SocialApp.YogaManager::CookingAppointment()
br IL_000E: nop
call System.Void SocialApp.YogaManager::CookingAppointment()
call System.Void SocialApp.HabitApp::FamilyBooster()
ldsfld System.String SocialApp.YogaManager::MealPrepManager
call System.String SocialApp.CyclingTracker::WaterLog()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_006C: ldsfld System.String SocialApp.YogaManager::ContractLogger
call System.Void MeditationTracker.MindCalculator::ReporterDiary()
ldsfld System.String SocialApp.YogaManager::ContractLogger
call System.Boolean SocialInventory.TaskFinance::WeatherManager(System.String)
brtrue IL_0080: call System.Void SocialInventory.ConverterTool::SymptomConverter()
leave IL_029D: ret
call System.Void SocialInventory.ConverterTool::SymptomConverter()
call System.Void GlucoseApp.ConverterTimer::PersonalTool()
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldfld System.Boolean SocialApp.ReporterScheduler::PlannerSaver
brtrue IL_027F: ldc.i4 200
ldsfld System.String SocialApp.YogaManager::TaxMonitor
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_0
ldloc V_0
ldsfld System.Random GlucoseApp.ConverterTimer::StudyAnalyzer
ldloc V_0
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem System.String
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_1
ldloc V_1
ldc.i4 1
ldelem System.String
ldc.i4 1
newarr System.Char
dup <null>
ldc.i4 0
ldc.i4 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_2
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
callvirt System.Void SocialApp.ReporterScheduler::AnalyzerAnalyzer()
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldloc V_1
ldc.i4 0
ldelem System.String
ldloc V_2
ldsfld System.Random GlucoseApp.ConverterTimer::StudyAnalyzer
ldloc V_2
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem System.String
callvirt System.Void SocialApp.ReporterScheduler::ClassPlanner(System.String,System.String)
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldfld System.Boolean SocialApp.ReporterScheduler::PlannerSaver
brfalse IL_027F: ldc.i4 200
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
newobj System.Void GlucoseApp.YogaTracker::.ctor(SocialApp.ReporterScheduler)
stfld GlucoseApp.YogaTracker SocialApp.ReporterScheduler::MealPrepTracker
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
newobj System.Void GlucoseApp.TherapyMonitor::.ctor(SocialApp.ReporterScheduler)
stfld GlucoseApp.TherapyMonitor SocialApp.ReporterScheduler::WeightManager
ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
ldc.i4 15
newarr System.Object
dup <null>
ldc.i4 0
call System.String SocialApp.CyclingTracker::ChoreDiary()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
stelem.ref <null>
dup <null>
ldc.i4 1
call System.Byte[] GlucoseApp.ConverterTimer::FitnessCalculator()
stelem.ref <null>
dup <null>
ldc.i4 2
ldsfld System.String SocialApp.YogaManager::VaultTracker
stelem.ref <null>
dup <null>
ldc.i4 3
ldsfld System.String SocialApp.YogaManager::ReminderTimer
stelem.ref <null>
dup <null>
ldc.i4 4
call System.String System.Environment::get_UserName()
call System.String SocialApp.CyclingTracker::WorkoutManager()
call System.String SocialInventory.YogaFormingApp::DietTracker(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4 5
ldsfld System.String SocialApp.YogaManager::HomeTracker
stelem.ref <null>
dup <null>
ldc.i4 6
ldsfld System.String SocialApp.YogaManager::WeightCalculator
stelem.ref <null>
dup <null>
ldc.i4 7
ldsfld System.String SocialApp.YogaManager::AppTracker
stelem.ref <null>
dup <null>
ldc.i4 8
ldsfld System.String SocialApp.YogaManager::SymptomApp
stelem.ref <null>
dup <null>
ldc.i4 9
ldsfld System.String SocialApp.YogaManager::DietLogger
stelem.ref <null>
dup <null>
ldc.i4 10
ldsfld System.String SocialApp.YogaManager::PlannerTranslator
stelem.ref <null>
dup <null>
ldc.i4 11
ldsfld System.String SocialApp.YogaManager::ConverterMonitor
stelem.ref <null>
dup <null>
ldc.i4 12
ldsfld System.String SocialApp.YogaManager::FoodTracker
stelem.ref <null>
dup <null>
ldc.i4 13
call System.Int32 GlucoseApp.ConverterTimer::DietGenerator()
box System.Int32
stelem.ref <null>
dup <null>
ldc.i4 14
call System.String GlucoseApp.ConverterTimer::SmartCreator()
stelem.ref <null>
call System.Byte[] GlucoseApp.MindAnalyzer::YogaSecurity(System.Object[])
callvirt System.Void SocialApp.ReporterScheduler::PrescriptionInventory(System.Byte[])
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_008A: ldsfld SocialApp.ReporterScheduler SocialApp.SummaryJournal::SmartManager
callvirt System.String System.Object::ToString()
call System.Void System.Console::WriteLine(System.String)
leave IL_029D: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙