Suspicious
Suspect

PE Executable
MD5: 349f53e15d2007d245a98db8547e0643
Size: 1.38 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 349f53e15d2007d245a98db8547e0643
Sha1 2c9900f006b356b209e5d26f8890e20e2f0f6641
Sha256 7f686552b74e86a919d7c4ef8eee991bdc70a3558d886a70ed8a879ecb9781af
Sha384 5eff59b18733d53d0e996a4263eecf195d3c89e1ab6007156004c48d3b861a71c7e1aa8b1fc44de129ab94b2262cb8ae
Sha512 b46a32843d3d0c7f39370aca694bc4a05b441f915e86a4025e6d0598ee24684c0ed7f0774f40129bafac0316cf22ba1c7169a1ddb91ac3e14968004fbaef032e
SSDeep 24576:2dZZzdCJvkYzllNkPbdb9tV2CDCnRveYepqMKDmfC4KOSSn2z6OTUS:2vZzdizzjepb96vRveYkqM3fC41p21
TLSH 0355F12923E94A04F1FF4F397AB804540BF0BD2B9A31EA6E6A5641DD4E64F44ED21373
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
349f53e15d2007d245a98db8547e0643
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
5FkrRcp3g1Pz.g.resources
5FkrRcp3g1Pz.Resources.resources
376e2dc12d3af7.Resources.resources
5c80e4390
[NBF]root.Data
5c80e4391
[NBF]root.Data
5c80e43910
[NBF]root.Data
5c80e43911
[NBF]root.Data
5c80e43912
[NBF]root.Data
5c80e43913
[NBF]root.Data
5c80e43914
[NBF]root.Data
5c80e43915
[NBF]root.Data
5c80e43916
[NBF]root.Data
5c80e43917
[NBF]root.Data
5c80e43918
[NBF]root.Data
5c80e43919
[NBF]root.Data
5c80e4392
[NBF]root.Data
5c80e43920
[NBF]root.Data
5c80e43921
[NBF]root.Data
5c80e43922
[NBF]root.Data
5c80e43923
[NBF]root.Data
5c80e43924
[NBF]root.Data
5c80e43925
[NBF]root.Data
5c80e43926
[NBF]root.Data
5c80e43927
[NBF]root.Data
5c80e43928
[NBF]root.Data
5c80e43929
[NBF]root.Data
5c80e4393
[NBF]root.Data
5c80e43930
[NBF]root.Data
5c80e43931
[NBF]root.Data
5c80e43932
[NBF]root.Data
5c80e43933
[NBF]root.Data
5c80e43934
[NBF]root.Data
5c80e43935
[NBF]root.Data
5c80e43936
[NBF]root.Data
5c80e43937
[NBF]root.Data
5c80e43938
[NBF]root.Data
5c80e43939
[NBF]root.Data
5c80e4394
[NBF]root.Data
5c80e43940
[NBF]root.Data
5c80e43941
[NBF]root.Data
5c80e4395
[NBF]root.Data
5c80e4396
[NBF]root.Data
5c80e4397
[NBF]root.Data
5c80e4398
[NBF]root.Data
5c80e4399
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
5FkrRcp3g1Pz
Full Name
5FkrRcp3g1Pz
EntryPoint
System.Void 5FkrRcp3g1Pz.Hw3x9jpFiG/in8ZLte0.Wdr09t::2JkfF_5a9Zf()
Scope Name
5FkrRcp3g1Pz
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5FkrRcp3g1Pz
Assembly Version
8.10.47.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void 5FkrRcp3g1Pz.Hw3x9jpFiG/in8ZLte0.Wdr09t::2JkfF_5a9Zf()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void 5FkrRcp3g1Pz.9nzGjWq42xAyK7::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
Module Name
5FkrRcp3g1Pz
Full Name
5FkrRcp3g1Pz
EntryPoint
System.Void 5FkrRcp3g1Pz.Hw3x9jpFiG/in8ZLte0.Wdr09t::2JkfF_5a9Zf()
Scope Name
5FkrRcp3g1Pz
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5FkrRcp3g1Pz
Assembly Version
8.10.47.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void 5FkrRcp3g1Pz.Hw3x9jpFiG/in8ZLte0.Wdr09t::2JkfF_5a9Zf()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void 5FkrRcp3g1Pz.9nzGjWq42xAyK7::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
349f53e15d2007d245a98db8547e0643
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
5FkrRcp3g1Pz.g.resources
5FkrRcp3g1Pz.Resources.resources
376e2dc12d3af7.Resources.resources
5c80e4390
[NBF]root.Data
5c80e4391
[NBF]root.Data
5c80e43910
[NBF]root.Data
5c80e43911
[NBF]root.Data
5c80e43912
[NBF]root.Data
5c80e43913
[NBF]root.Data
5c80e43914
[NBF]root.Data
5c80e43915
[NBF]root.Data
5c80e43916
[NBF]root.Data
5c80e43917
[NBF]root.Data
5c80e43918
[NBF]root.Data
5c80e43919
[NBF]root.Data
5c80e4392
[NBF]root.Data
5c80e43920
[NBF]root.Data
5c80e43921
[NBF]root.Data
5c80e43922
[NBF]root.Data
5c80e43923
[NBF]root.Data
5c80e43924
[NBF]root.Data
5c80e43925
[NBF]root.Data
5c80e43926
[NBF]root.Data
5c80e43927
[NBF]root.Data
5c80e43928
[NBF]root.Data
5c80e43929
[NBF]root.Data
5c80e4393
[NBF]root.Data
5c80e43930
[NBF]root.Data
5c80e43931
[NBF]root.Data
5c80e43932
[NBF]root.Data
5c80e43933
[NBF]root.Data
5c80e43934
[NBF]root.Data
5c80e43935
[NBF]root.Data
5c80e43936
[NBF]root.Data
5c80e43937
[NBF]root.Data
5c80e43938
[NBF]root.Data
5c80e43939
[NBF]root.Data
5c80e4394
[NBF]root.Data
5c80e43940
[NBF]root.Data
5c80e43941
[NBF]root.Data
5c80e4395
[NBF]root.Data
5c80e4396
[NBF]root.Data
5c80e4397
[NBF]root.Data
5c80e4398
[NBF]root.Data
5c80e4399
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙