Deep Malware Analysis of 29fe059bb3cfc7db5c8ce6b49ed00813 | md5: 29fe059bb3cfc7db5c8ce6b49ed00813 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.87

PE Executable

MD5: 29fe059bb3cfc7db5c8ce6b49ed00813

Size: 881.66 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	29fe059bb3cfc7db5c8ce6b49ed00813
Sha1	19f771cc076990bc92262d1cd6851bdf2c5aaf13
Sha256	67fd31f9b85ca5e31e0851c8a5f8f2f36343d884aa3dd7f26d4aa6c5d02b28fe
Sha384	f037d54bd196737272251d016c4ffc2be05437d3cca607093e891ac0b56d7a7b8857c36a829489b61112edaa506c88a4
Sha512	6b65d3e99ece01800b68992053b5d632bfd4455f2705e5f10a26fc4c2fd7f966eb7a1accf03be7b43a891b17cf2074b2f2682325bb108fdc4d74e3309e8149f5
SSDeep	24576:lsDN+4sX9WK9QsNvjs6tuJwvVcvsojzpq:loNKX9WK9Qo7s6tuJ82
TLSH	AA15332EF1884ABADA2BF735C7C1AC807440821A1C96554DFC5DC78F8BAA607F235D6D

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Hvnxjhgy.exe
Full Name	Hvnxjhgy.exe
EntryPoint	System.Void Cevqupnswk.Helpers.ExtendedChooser::AttachChooser()
Scope Name	Hvnxjhgy.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Hvnxjhgy
Assembly Version	1.0.8647.28677
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	6
Main Method	System.Void Cevqupnswk.Helpers.ExtendedChooser::AttachChooser()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void Hvnxjhgy.Registry.FlexibleReg::.ctor() call System.Byte[] Hvnxjhgy.Registry.FlexibleReg::SaveExternalReg() call System.Byte[] Cevqupnswk.Handling.InternalHandler::AssessHandler(System.Object) call System.Void Hvnxjhgy.Collections.IteratorChecker::CountCustomSet(System.Object) ldc.i4 0 ldsfld <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9} <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9}::m_03326827fcf24cf691d3e76eb8a5f04a ldfld System.Int32 <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9}::m_e1594d28a8074df982affdc5e4fff16d brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>
Module Name	Hvnxjhgy.exe
Full Name	Hvnxjhgy.exe
EntryPoint	System.Void Cevqupnswk.Helpers.ExtendedChooser::AttachChooser()
Scope Name	Hvnxjhgy.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Hvnxjhgy
Assembly Version	1.0.8647.28677
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	6
Main Method	System.Void Cevqupnswk.Helpers.ExtendedChooser::AttachChooser()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void Hvnxjhgy.Registry.FlexibleReg::.ctor() call System.Byte[] Hvnxjhgy.Registry.FlexibleReg::SaveExternalReg() call System.Byte[] Cevqupnswk.Handling.InternalHandler::AssessHandler(System.Object) call System.Void Hvnxjhgy.Collections.IteratorChecker::CountCustomSet(System.Object) ldc.i4 0 ldsfld <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9} <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9}::m_03326827fcf24cf691d3e76eb8a5f04a ldfld System.Int32 <Module>{2a77625f-b31c-489c-bdfd-10b8dd09c9b9}::m_e1594d28a8074df982affdc5e4fff16d brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.