Deep Malware Analysis of 342a32ac562810b536c369e3f5cdda27 | md5: 342a32ac562810b536c369e3f5cdda27 | .Net | PE (Portable Executable) | SOS: 0.61 | Executable | .Net Obfuscator | .Net Reactor | Managed .NET | PE File Layout | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	342a32ac562810b536c369e3f5cdda27
Sha1	ac0d1fcd654ee302e84a7a91a33d0f84cac9c63d
Sha256	4018da487297614f041f01b5bffe425f6a4ca43b045455b4c4ac20c04b92a61d
Sha384	61c140bf53b94b98b2b9047ab705b669b1a5490148f91ba99343b1994618e81906a1b57bfa14537ef57d4a2e5dcbc52a
Sha512	0710dfacb9de96d1d595b6e96a1567b11970475f33b00bf750d5b05b2bf52a9e55446edcd3607bfa280f690e71b0a53aa224217520311a0b22e4c8d6e84ec3c6
SSDeep	12288:xsTkTpX6SZzpX8zmc0QzCRtNRWFAt27XxldI2oSokTI2pA05ze386Uoavg:xsApKKX8ZZCRLRxcld9FoVD8C6oav
TLSH	D115BEAA3ADAD829F0764E70C4A1F2F243709E90D721D1179EE67DC77932B8046C674B

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	hOzE.exe
Full Name	hOzE.exe
EntryPoint	System.Void krK.fra::zrW()
Scope Name	hOzE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	hOzE
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	741
Main Method	System.Void krK.fra::zrW()
Main IL Instruction Count	19
Main IL	br IL_0026: nop ldsfld jc.Qs krK.fra::k51 call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0024: nop nop <null> newobj System.Void jc.Qs::.ctor() stsfld jc.Qs krK.fra::k51 br IL_0005: ldsfld jc.Qs krK.fra::k51 nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0031: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_003D: call System.Void D5A.d5w::Enn() call System.Void D5A.d5w::Enn() br IL_0014: nop
Info	PE Detect: PeReader OK (file layout)
Module Name	hOzE.exe
Full Name	hOzE.exe
EntryPoint	System.Void krK.fra::zrW()
Scope Name	hOzE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	hOzE
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	741
Main Method	System.Void krK.fra::zrW()
Main IL Instruction Count	19
Main IL	br IL_0026: nop ldsfld jc.Qs krK.fra::k51 call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0024: nop nop <null> newobj System.Void jc.Qs::.ctor() stsfld jc.Qs krK.fra::k51 br IL_0005: ldsfld jc.Qs krK.fra::k51 nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0031: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_003D: call System.Void D5A.d5w::Enn() call System.Void D5A.d5w::Enn() br IL_0014: nop