244fb2baa716b6f614b3fc5cfa475834

PE Executable

MD5: 244fb2baa716b6f614b3fc5cfa475834

Size: 187.9 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	244fb2baa716b6f614b3fc5cfa475834
Sha1	95dae7317a09beaf46281782b04afabb7a3e91da
Sha256	dbc3776087a78b2a0543372171a1986713437db826cf9dbbb83035d8e463ce2a
Sha384	e702a3a30f82410b8593f72db02bb6862388c2bd7d66f6a59dbf706f9d6edc70fa3a29153ff524c9cc5fa93bd57d935f
Sha512	2fc0332368169b299c3aa68e74d8f5f70c7587b7e82294badbec2a9cefa788863c0c9398d2f0b9fe6ae9563a77f3b51d9f457a078c45b56a62146601832d47e0
SSDeep	3072:i+UXnPBYp08gNNwYX6EOENamRHt7dz/Ae/RcBJoP00TsCDxKK96ZXVUEWIhJMS:i++qpDgnwYXiFmRHfAep62V7xlKN
TLSH	3804124AA7FA8906F3FB55BE40B2025136B5EE08DF26E31E06D093B51613B944F10F6B

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

10 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 3img 3oox:metadata 1oox:style 1oox:theme 1xml 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Sowpost-Setup.exe
Full Name	Sowpost-Setup.exe
EntryPoint	System.Int32 SowpostCapNhat::Main(System.String[])
Scope Name	Sowpost-Setup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Sowpost-Setup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	96
Main Method	System.Int32 SowpostCapNhat::Main(System.String[])
Main IL Instruction Count	17
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0025: call System.Int32 SowpostCapNhat::CaiDat() ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr chrome-extension:// callvirt System.Boolean System.String::StartsWith(System.String) brfalse.s IL_0025: call System.Int32 SowpostCapNhat::CaiDat() call System.Int32 SowpostCapNhat::CheDoHost() ret <null> call System.Int32 SowpostCapNhat::CaiDat() ret <null>
Module Name	Sowpost-Setup.exe
Full Name	Sowpost-Setup.exe
EntryPoint	System.Int32 SowpostCapNhat::Main(System.String[])
Scope Name	Sowpost-Setup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Sowpost-Setup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	96
Main Method	System.Int32 SowpostCapNhat::Main(System.String[])
Main IL Instruction Count	17
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0025: call System.Int32 SowpostCapNhat::CaiDat() ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr chrome-extension:// callvirt System.Boolean System.String::StartsWith(System.String) brfalse.s IL_0025: call System.Int32 SowpostCapNhat::CaiDat() call System.Int32 SowpostCapNhat::CheDoHost() ret <null> call System.Int32 SowpostCapNhat::CaiDat() ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.