2349f91c150b1597e8d0c607f0af2e8b

PE Executable

MD5: 2349f91c150b1597e8d0c607f0af2e8b

Size: 1.51 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	2349f91c150b1597e8d0c607f0af2e8b
Sha1	6315468fa43367f9039c97ce9ec6b0ddcb2ad3f5
Sha256	b77480a82345142a84cefc317db53e3c008de0f75c8044cb536a7a266badb28d
Sha384	58c04c7478c2302f9312dea3dbba8415d17dbcbdfa64ea580fbcef22306779794e9dc9f575a2c6a942deed62cef461f5
Sha512	13a29fd8a6a4994f43fa5db255c4cd9c95d03afd8581235b8c77a06fecb39299b7e1d2dbb4d2b2ec07fd67737b36c68c161a2a312e13d962c3c5b0654ed50f75
SSDeep	24576:0meUNuA6gK0jVSlpJt0autFioSo5alEqYA0yFfP3789rFrTR+rThKqWZ38I87cJ/:HeUggK+u0FSo5zy0yFfP3khmF7cJt3vu
TLSH	55651264234DCA02C5A74BF01D71D6B527A88F98E511D3039EFABEEFB929B197C50243

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0UPolyX 0.3 -> delikon

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Module Name	USPJ.exe
Full Name	USPJ.exe
EntryPoint	System.Void CaveSystem.Program::Main()
Scope Name	USPJ.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	USPJ
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	282
Main Method	System.Void CaveSystem.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void CaveSystem.CaveForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.