Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 31890f2cb91496641ba93ad28539e93b
Size: 1.58 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 31890f2cb91496641ba93ad28539e93b
Sha1 32e382fbbad88051bc91038cb928a4f2247f692b
Sha256 5b8efcc4d2e4dbabcee1ecd25d97cd0624ea1a9882225e382423079f7907876b
Sha384 7f00d7c7ce36caea83984136108fb3b4ae94e613e0e85a70b65edd29e0f61dc9c1b8f4738b94406ec414dd66839d0616
Sha512 2e116b90a09264256b88ed0ab6e22d8238180c7e76488e7827b56521e84819afc481b122fc62bb2694db2498356b744f84b82a78efbd1ea1f9d5b59a03fc7dd0
SSDeep 24576:wp95ixSVeAZ3RzsfqvbRB/6Z7jg0iCA1eQxaOnA2SzmF1k76dRjUsDR8RmAkV/wi:wfAWp3RXXgH/A1e/pa19ksdYAWez
TLSH 2E753363FE6B8DDDE211DC3C6E6A82C50095AB533499CC6CD569326B0CA4C632ED76F0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
31890f2cb91496641ba93ad28539e93b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr l1EyaIv/QnzsZGp9cU1sxw==
ldstr +On5tmViGGX9qKeNFxnTamfAx0s0b4WOJFMb8cgBGX8=
ldstr cMNKnc9CqiuvzDsccozbcQ==
call System.String ᪝ꯕⳁ䲾늀±磺勊饷::덡늲깑Ⴥ쳳抢຀裆湐(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr l1EyaIv/QnzsZGp9cU1sxw==
ldstr +On5tmViGGX9qKeNFxnTamfAx0s0b4WOJFMb8cgBGX8=
ldstr cMNKnc9CqiuvzDsccozbcQ==
call System.String ᪝ꯕⳁ䲾늀±磺勊饷::덡늲깑Ⴥ쳳抢຀裆湐(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWNsuspect
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙