2440ef413da8b069c5387a7ae8696365

PE Executable

MD5: 2440ef413da8b069c5387a7ae8696365

Size: 47.48 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	2440ef413da8b069c5387a7ae8696365
Sha1	c22fa10c547dc190c4fc11589efe7d869968a49f
Sha256	5e59e96cc1192ef28e465b26ac1cf238e9d0eccecba00cc3d4eeeb6c4a8947a2
Sha384	4fdb17bd7bce8b0389fed356aa954d7d8fb8da63f2c1fd3df56d707cbc55400439dee2c9fdb48aa5fa9e93e7663edaf2
Sha512	4d7c27858411ee953e85231fe0082161d0163706839dc09dbc95dc9e5bd1c382a8f239126c2dd857c98ebfde1008573fcf76e13b48258f287061cac9714122a1
SSDeep	768:3dvwHa/7/xgxrRTX5FuRvfoBwez3xZyL/r+m8/fy+J1/tOXDUSvGmt/ibF6aOc:Aa/9CdXLQvfoue7XyL/r+y+jtaDUSvtO
TLSH	3D23F24613D14A2DE8AC223656B917C823B0F6518252EBADBCCC5F7DFD627608819F88

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_4d9c7786.bin (41336 bytes)
Module Name	loader-template.exe
Full Name	loader-template.exe
EntryPoint	System.Void AppHost.Program::Main()
Scope Name	loader-template.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	loader-template
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	2
Main Method	System.Void AppHost.Program::Main()
Main IL Instruction Count	62
Main IL	ldsfld System.Byte[] AppHost.Program::BuildStampMarker brfalse.s IL_0010: leave.s IL_0085 ldsfld System.Byte[] AppHost.Program::BuildStampMarker ldlen <null> conv.i4 <null> brtrue.s IL_0012: call System.Byte[] AppHost.Program::Unpack() leave.s IL_0085: ret call System.Byte[] AppHost.Program::Unpack() stloc.0 <null> ldloc.0 <null> brfalse.s IL_0022: leave.s IL_0085 ldloc.0 <null> ldlen <null> conv.i4 <null> ldc.i4.s 64 bge.s IL_0024: call System.AppDomain System.AppDomain::get_CurrentDomain() leave.s IL_0085: ret call System.AppDomain System.AppDomain::get_CurrentDomain() ldstr RT_PE ldloc.0 <null> callvirt System.Void System.AppDomain::SetData(System.String,System.Object) ldloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.1 <null> ldloc.1 <null> callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.2 <null> ldloc.2 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_004D: ldloc.2 leave.s IL_0085: ret ldloc.2 <null> callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() stloc.3 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> brtrue.s IL_0064: ldloc.2 ldloc.2 <null> ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> br.s IL_0080: leave.s IL_0085 ldloc.2 <null> ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.0 <null> newarr System.String stelem.ref <null> ldloc.s V_4 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0085: ret pop <null> leave.s IL_0085: ret ret <null>
Module Name	loader-template.exe
Full Name	loader-template.exe
EntryPoint	System.Void AppHost.Program::Main()
Scope Name	loader-template.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	loader-template
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	2
Main Method	System.Void AppHost.Program::Main()
Main IL Instruction Count	62
Main IL	ldsfld System.Byte[] AppHost.Program::BuildStampMarker brfalse.s IL_0010: leave.s IL_0085 ldsfld System.Byte[] AppHost.Program::BuildStampMarker ldlen <null> conv.i4 <null> brtrue.s IL_0012: call System.Byte[] AppHost.Program::Unpack() leave.s IL_0085: ret call System.Byte[] AppHost.Program::Unpack() stloc.0 <null> ldloc.0 <null> brfalse.s IL_0022: leave.s IL_0085 ldloc.0 <null> ldlen <null> conv.i4 <null> ldc.i4.s 64 bge.s IL_0024: call System.AppDomain System.AppDomain::get_CurrentDomain() leave.s IL_0085: ret call System.AppDomain System.AppDomain::get_CurrentDomain() ldstr RT_PE ldloc.0 <null> callvirt System.Void System.AppDomain::SetData(System.String,System.Object) ldloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.1 <null> ldloc.1 <null> callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.2 <null> ldloc.2 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_004D: ldloc.2 leave.s IL_0085: ret ldloc.2 <null> callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() stloc.3 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> brtrue.s IL_0064: ldloc.2 ldloc.2 <null> ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> br.s IL_0080: leave.s IL_0085 ldloc.2 <null> ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.0 <null> newarr System.String stelem.ref <null> ldloc.s V_4 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0085: ret pop <null> leave.s IL_0085: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.