Deep Malware Analysis of 23bfaff7aff7af5807bac2244b7219e1 | md5: 23bfaff7aff7af5807bac2244b7219e1 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.80

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	23bfaff7aff7af5807bac2244b7219e1
Sha1	e9a2dc6b6d60ea448e7b570bd2893f6efc0523fb
Sha256	b9622cc44be9b2902beb1c399bcb15b6ee711d6d72ca1a9e82e96e957c231fe2
Sha384	48b5c1120c760d70a17f9d382f1ef2ba015db61b7c8c3c5cfa11019c07c9610e03bee008316657d6490ab47c3f620945
Sha512	b4319b929cc9425e0f84c4b3eb3e0789db6f7c1bcf2cb45583e9598f175c20638146eb7ad0a6677732da7aca8594fe199e044accc078452483cc8b56eaba0469
SSDeep	3072:w9hnBRU+3Aclfnphf/9fZkBY8hk4KFNLtbYfuTJOH:wzBu+Qclrf/9fmBY8hkbFNLtkml
TLSH	BA54ECC62A72DE2FF84C70F1D028B8629E1CBEA50DA7F6439CF6759D0479A124B541E3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	traslp.exe
Full Name	traslp.exe
EntryPoint	System.Void atraslp.CDSEKwM::CNtpvmYkp()
Scope Name	traslp.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	traslp
Assembly Version	1.0.0.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1
Main Method	System.Void atraslp.CDSEKwM::CNtpvmYkp()
Main IL Instruction Count	13
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 -99896787 ldc.i4 -99896788 xor <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_003A: ret newobj System.Void atraslp.edYEmVM::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 -99896788 br.s IL_0010: ldc.i4 -99896788 ret <null>`
Module Name	traslp.exe
Full Name	traslp.exe
EntryPoint	System.Void atraslp.CDSEKwM::CNtpvmYkp()
Scope Name	traslp.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	traslp
Assembly Version	1.0.0.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1
Main Method	System.Void atraslp.CDSEKwM::CNtpvmYkp()
Main IL Instruction Count	13
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 -99896787 ldc.i4 -99896788 xor <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_003A: ret newobj System.Void atraslp.edYEmVM::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 -99896788 br.s IL_0010: ldc.i4 -99896788 ret <null>`