2d6a70c88b9a6f12cf1e9aef4c45d7fd

PE Executable

MD5: 2d6a70c88b9a6f12cf1e9aef4c45d7fd

Size: 750.08 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	2d6a70c88b9a6f12cf1e9aef4c45d7fd
Sha1	24375d9ccff441f71e36eb0b57bc9815d9b2edb7
Sha256	d592e061c641ef816a8dc1a6d83d36578a84df47f3b063c06299c8debc4b8a21
Sha384	51cbc3a5424581f1d4b1264c55aeedf6d96720c89ec486b9a10c1b912b670b328b36b6e84c53ea8ee844bc4bb4550126
Sha512	62a3da716d87da787ee70b86a2d42d49b8a8f4cd87a506464b047354fc5f0050ff3e7aae687a9abdb0dc7d496ea3d4938ab8085f9fc8ed20d96c7846a20f727f
SSDeep	12288:VNV7nw9c4dqsewB1ESqys6ju306ygv2ibPy4wi2+5WbJ4iX7JcD+:VNVsu4o/IB42ibPJwauJ4m7Jci
TLSH	B8F4124CB77A7625D10C1F7A9493534482F3481FA8B3F95AAABC08D15F14BB885CEB4B

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	kgCa.exe
Full Name	kgCa.exe
EntryPoint	System.Void SecureMode.Program::Main()
Scope Name	kgCa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kgCa
Assembly Version	1.6.1908.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	2
Main Method	System.Void SecureMode.Program::Main()
Main IL Instruction Count	21
Main IL	ldc.i4.0 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void SecureMode.AdvancedForm20::Ⴀ() ldc.i4 248 ldc.i4 252 call System.Void SecureMode.ProfessionalForm65::Ⴄ(System.Char,System.Char) ldc.i4.0 <null> ldc.i4 576 ldc.i4 545 call System.Void SecureMode.AsyncForm59::Ⴍ(System.Boolean,System.Int16,System.Int32) ldc.i4.2 <null> stloc.1 <null> br.s IL_0002: ldloc.1 newobj System.Void SecureMode.ProfessionalForm53::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null> ldtoken System.Void SecureMode.Program::Main() pop <null> ret <null>
Module Name	kgCa.exe
Full Name	kgCa.exe
EntryPoint	System.Void SecureMode.Program::Main()
Scope Name	kgCa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kgCa
Assembly Version	1.6.1908.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	2
Main Method	System.Void SecureMode.Program::Main()
Main IL Instruction Count	21
Main IL	ldc.i4.0 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void SecureMode.AdvancedForm20::Ⴀ() ldc.i4 248 ldc.i4 252 call System.Void SecureMode.ProfessionalForm65::Ⴄ(System.Char,System.Char) ldc.i4.0 <null> ldc.i4 576 ldc.i4 545 call System.Void SecureMode.AsyncForm59::Ⴍ(System.Boolean,System.Int16,System.Int32) ldc.i4.2 <null> stloc.1 <null> br.s IL_0002: ldloc.1 newobj System.Void SecureMode.ProfessionalForm53::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null> ldtoken System.Void SecureMode.Program::Main() pop <null> ret <null>

Embedded Resources UNKNWOWN

0huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWN

0huhuhuhu

2d6a70c88b9a6f12cf1e9aef4c45d7fd

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

2d6a70c88b9a6f12cf1e9aef4c45d7fd

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.