Suspicious
Suspect

PE Executable
MD5: 31890f2cb91496641ba93ad28539e93b
Size: 1.58 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 31890f2cb91496641ba93ad28539e93b
Sha1 32e382fbbad88051bc91038cb928a4f2247f692b
Sha256 5b8efcc4d2e4dbabcee1ecd25d97cd0624ea1a9882225e382423079f7907876b
Sha384 7f00d7c7ce36caea83984136108fb3b4ae94e613e0e85a70b65edd29e0f61dc9c1b8f4738b94406ec414dd66839d0616
Sha512 2e116b90a09264256b88ed0ab6e22d8238180c7e76488e7827b56521e84819afc481b122fc62bb2694db2498356b744f84b82a78efbd1ea1f9d5b59a03fc7dd0
SSDeep 24576:wp95ixSVeAZ3RzsfqvbRB/6Z7jg0iCA1eQxaOnA2SzmF1k76dRjUsDR8RmAkV/wi:wfAWp3RXXgH/A1e/pa19ksdYAWez
TLSH 2E753363FE6B8DDDE211DC3C6E6A82C50095AB533499CC6CD569326B0CA4C632ED76F0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
31890f2cb91496641ba93ad28539e93b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr l1EyaIv/QnzsZGp9cU1sxw==
ldstr +On5tmViGGX9qKeNFxnTamfAx0s0b4WOJFMb8cgBGX8=
ldstr cMNKnc9CqiuvzDsccozbcQ==
call System.String ᪝ꯕⳁ䲾늀±磺勊饷::덡늲깑Ⴥ쳳抢຀裆湐(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr l1EyaIv/QnzsZGp9cU1sxw==
ldstr +On5tmViGGX9qKeNFxnTamfAx0s0b4WOJFMb8cgBGX8=
ldstr cMNKnc9CqiuvzDsccozbcQ==
call System.String ᪝ꯕⳁ䲾늀±磺勊饷::덡늲깑Ⴥ쳳抢຀裆湐(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWNsuspect
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
31890f2cb91496641ba93ad28539e93b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
31890f2cb91496641ba93ad28539e93b
Suspicious Type Names (1-2 chars) UNKNWOWNsuspect
1huhuhuhu
31890f2cb91496641ba93ad28539e93b
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙