Suspicious
Suspect

2d6a70c88b9a6f12cf1e9aef4c45d7fd

Share on LinkedIn
Print
PE Executable
MD5: 2d6a70c88b9a6f12cf1e9aef4c45d7fd
Size: 750.08 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 2d6a70c88b9a6f12cf1e9aef4c45d7fd
Sha1 24375d9ccff441f71e36eb0b57bc9815d9b2edb7
Sha256 d592e061c641ef816a8dc1a6d83d36578a84df47f3b063c06299c8debc4b8a21
Sha384 51cbc3a5424581f1d4b1264c55aeedf6d96720c89ec486b9a10c1b912b670b328b36b6e84c53ea8ee844bc4bb4550126
Sha512 62a3da716d87da787ee70b86a2d42d49b8a8f4cd87a506464b047354fc5f0050ff3e7aae687a9abdb0dc7d496ea3d4938ab8085f9fc8ed20d96c7846a20f727f
SSDeep 12288:VNV7nw9c4dqsewB1ESqys6ju306ygv2ibPy4wi2+5WbJ4iX7JcD+:VNVsu4o/IB42ibPJwauJ4m7Jci
TLSH B8F4124CB77A7625D10C1F7A9493534482F3481FA8B3F95AAABC08D15F14BB885CEB4B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2d6a70c88b9a6f12cf1e9aef4c45d7fd
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
kgCa.exe
Full Name
kgCa.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
kgCa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kgCa
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
21
Main IL 
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.AdvancedForm20::Ⴀ()
ldc.i4 248
ldc.i4 252
call System.Void SecureMode.ProfessionalForm65::Ⴄ(System.Char,System.Char)
ldc.i4.0 <null>
ldc.i4 576
ldc.i4 545
call System.Void SecureMode.AsyncForm59::Ⴍ(System.Boolean,System.Int16,System.Int32)
ldc.i4.2 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Module Name
kgCa.exe
Full Name
kgCa.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
kgCa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kgCa
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
21
Main IL 
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.AdvancedForm20::Ⴀ()
ldc.i4 248
ldc.i4 252
call System.Void SecureMode.ProfessionalForm65::Ⴄ(System.Char,System.Char)
ldc.i4.0 <null>
ldc.i4 576
ldc.i4 545
call System.Void SecureMode.AsyncForm59::Ⴍ(System.Boolean,System.Int16,System.Int32)
ldc.i4.2 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙