229ab3701232294a98a509679d8e4c0c

PE Executable

MD5: 229ab3701232294a98a509679d8e4c0c

Size: 902.14 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	229ab3701232294a98a509679d8e4c0c
Sha1	c20c8e590c0503e6ee3dfb706347e03dec700d4d
Sha256	0c7c2cd3483ee0b03e2cba1ec44eda97a509e6e97e51c695801e09382c6a41d7
Sha384	397db763a410e65a59924bc06c5c8b5afe0bd8653693749d247fdff99b889c123104943384580a032eb74c23ee3c2913
Sha512	226eadf89d66ee5d44a1f281127b49479d9af4abd58f8954795ee5d97e6e6bcac6546b0fc52173c9f21fb0bbc064e8ab37cb6398261f13c68306be16b32b2514
SSDeep	12288:GjNioWMcV/UZtUTh+EY7EApwa7vJGx5U+onp41J9B4f5P1YMUk/A+OSGlsFx8RYU:Gj+McFpYEAp7UxapIB4f5PjUk/dVr8N
TLSH	3015E09D7650B2DFC867C872DAA82C64EB6174BB430B8203906315EDEA4D99BCF151F3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1

Name	Value
Module Name	JaguarWare.exe
Full Name	JaguarWare.exe
EntryPoint	System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::⁭‪‪‪‏‮‏‍‏‏‏‪‎‎‎⁭⁮‮‫‏⁫⁬‌‎⁫⁮⁫⁯⁭⁯‭⁬‏‎‏‌⁬⁭‮()
Scope Name	JaguarWare.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JaguarWare
Assembly Version	7.5.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.1
Total Strings	11
Info	PE Detect: PeReader OK (file layout)
Main Method	System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::⁭‪‪‪‏‮‏‍‏‏‏‪‎‎‎⁭⁮‮‫‏⁫⁬‌‎⁫⁮⁫⁯⁭⁯‭⁬‏‎‏‌⁬⁭‮()
Main IL Instruction Count	6
Main IL	`newobj System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::.ctor() dup <null> callvirt System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::‌‎⁫⁮⁬‪⁯⁫‍‏‏⁬‏‪‬‭⁪⁫‭‌⁯‌‫⁭‎‮‪⁬‬‫‍⁯⁬‪‏‫‮() call System.Int32 XTrKUESAABYEHjYbEPfYohyTdfiG::⁪‍⁪‬‪‏‬⁮‪‮‪⁭‫‏⁪⁯⁫‌‫‌‪‏⁪‪‮⁭‍⁬‌⁮⁫‌⁬⁯‌⁯‮⁪‪‮(System.Windows.Application) pop <null> ret <null>`
Module Name	JaguarWare.exe
Full Name	JaguarWare.exe
EntryPoint	System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::⁭‪‪‪‏‮‏‍‏‏‏‪‎‎‎⁭⁮‮‫‏⁫⁬‌‎⁫⁮⁫⁯⁭⁯‭⁬‏‎‏‌⁬⁭‮()
Scope Name	JaguarWare.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JaguarWare
Assembly Version	7.5.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.1
Total Strings	11
Main Method	System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::⁭‪‪‪‏‮‏‍‏‏‏‪‎‎‎⁭⁮‮‫‏⁫⁬‌‎⁫⁮⁫⁯⁭⁯‭⁬‏‎‏‌⁬⁭‮()
Main IL Instruction Count	6
Main IL	`newobj System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::.ctor() dup <null> callvirt System.Void XTrKUESAABYEHjYbEPfYohyTdfiG::‌‎⁫⁮⁬‪⁯⁫‍‏‏⁬‏‪‬‭⁪⁫‭‌⁯‌‫⁭‎‮‪⁬‬‫‍⁯⁬‪‏‫‮() call System.Int32 XTrKUESAABYEHjYbEPfYohyTdfiG::⁪‍⁪‬‪‏‬⁮‪‮‪⁭‫‏⁪⁯⁫‌‫‌‪‏⁪‪‮⁭‍⁬‌⁮⁫‌⁬⁯‌⁯‮⁪‪‮(System.Windows.Application) pop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.