283e7a8daf1062758cb434c37b31688d

PE Executable

MD5: 283e7a8daf1062758cb434c37b31688d

Size: 796.67 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	283e7a8daf1062758cb434c37b31688d
Sha1	802fb4cb4475e6ddc02e814c14887ff53f98bd0f
Sha256	f72f02a29cb44d516fe3ca42978be88788037ea0fdeec9fd0908eb11dee41232
Sha384	2cf9e49a16444687e66aec2d85bafa5dcb21cb4b91d13739ed5c923be1b7084a743eb0fe175622173e1ac891011b3875
Sha512	deb069ac93a61df87a5dfbf1414e0197cf23363f0a10040086ea7d7c57b108e30608e4aa2aaea99b149169eeed54c4edf54b067fcbc14b49b4f3a34b00159356
SSDeep	12288:BjD4kz6fnmQOkkPV5RtI4Tw/ptbJDguy6vIwEhSLKl/y5jZdlp85ooWV02Z/5BlW:1J6fmQzECWuy6vIwEeBoy02ZB
TLSH	4305011DBE25AA31CB0D0FFBD503510C81F588A7EA72F3A758D98DD71A64BC5850EA43

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	JLnWv.exe
Full Name	JLnWv.exe
EntryPoint	System.Void DiskAnalyzer.Program::Main()
Scope Name	JLnWv.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JLnWv
Assembly Version	1.0.2.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void DiskAnalyzer.Program::Main()
Main IL Instruction Count	31
Main IL	ldsfld System.Byte[] DiskAnalyzer.Properties.Resources::Ⴐ stloc.2 <null> ldc.i4.0 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void DiskAnalyzer.AnalyseurDisque/InfoDossier::Ⴅ() ldc.i4 297 ldc.i4 282 call System.Void DiskAnalyzer.FormDoublons::Ⴃ(System.Char,System.Int16) ldc.i4.0 <null> ldc.i4.s 70 ldc.i4.s 39 call System.Void DiskAnalyzer.FormPrincipal::Ⴀ(System.Boolean,System.Int16,System.Int16) ldloc.2 <null> ldc.i4.s 63 ldelem.u1 <null> stloc.1 <null> br.s IL_0008: ldloc.1 newobj System.Void DiskAnalyzer.FormPrincipal::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldsfld System.Byte[] DiskAnalyzer.AnalyseurDisque/GroupeDoublons::Ⴓ ldc.i4.s 126 ldsfld System.Byte[] DiskAnalyzer.Properties.Resources::Ⴐ ldc.i4.s 56 ldelem.u1 <null> stelem.i1 <null> ret <null> ldtoken System.Void DiskAnalyzer.Program::Main() pop <null> ret <null>
Module Name	JLnWv.exe
Full Name	JLnWv.exe
EntryPoint	System.Void DiskAnalyzer.Program::Main()
Scope Name	JLnWv.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JLnWv
Assembly Version	1.0.2.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void DiskAnalyzer.Program::Main()
Main IL Instruction Count	31
Main IL	ldsfld System.Byte[] DiskAnalyzer.Properties.Resources::Ⴐ stloc.2 <null> ldc.i4.0 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void DiskAnalyzer.AnalyseurDisque/InfoDossier::Ⴅ() ldc.i4 297 ldc.i4 282 call System.Void DiskAnalyzer.FormDoublons::Ⴃ(System.Char,System.Int16) ldc.i4.0 <null> ldc.i4.s 70 ldc.i4.s 39 call System.Void DiskAnalyzer.FormPrincipal::Ⴀ(System.Boolean,System.Int16,System.Int16) ldloc.2 <null> ldc.i4.s 63 ldelem.u1 <null> stloc.1 <null> br.s IL_0008: ldloc.1 newobj System.Void DiskAnalyzer.FormPrincipal::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldsfld System.Byte[] DiskAnalyzer.AnalyseurDisque/GroupeDoublons::Ⴓ ldc.i4.s 126 ldsfld System.Byte[] DiskAnalyzer.Properties.Resources::Ⴐ ldc.i4.s 56 ldelem.u1 <null> stelem.i1 <null> ret <null> ldtoken System.Void DiskAnalyzer.Program::Main() pop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.