Suspicious
Suspect

PE Executable
MD5: 361c7e66254b49f2f0bf864e13c89b8e
Size: 802.3 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 361c7e66254b49f2f0bf864e13c89b8e
Sha1 46dc091ccae0019e818f5af7e8205bcaed2ff9cd
Sha256 8d1f945ab98dd2e36451a886f621535448aadeaebc7dddb5fa38eb5c047f4f4b
Sha384 bacfda4850c7fff0e37632e7f21e9b747ecea1ba664048018c6e6af54f2a27dec6ebc828f9fe1d18d96effd5eeed6c99
Sha512 c0480389c0ecc10bfc6fd4b79e6f1a37a2e49bdfb11f66cd7967fa7ada0dd1cbc50215070c0d16c3c31a41b1575416b27715d4c0f8457ae2a94d16beb0c96bd0
SSDeep 12288:+N2N7fN2jNouec0DW4fuedxRaJnCHFxIdOQ2RxkRh8iP/ZT0erQtZydyIBvguY9P:+N2r2j6dDDfBxRhbjxI5/Np/eH
TLSH 220575342EEA1029F177AF7D8AE47596EA6EB6A33707994D00B103C60723B42DDD153E
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
361c7e66254b49f2f0bf864e13c89b8e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
oNhln9lq3i
Full Name
oNhln9lq3i
EntryPoint
System.Void 74V.PEs::627()
Scope Name
oNhln9lq3i
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DB9farRJATwBRmyX
Assembly Version
6.7.3.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1779
Main Method
System.Void 74V.PEs::627()
Main IL Instruction Count
5
Main IL 
nop <null>
ldsfld ab2.2J2 74V.PEs::792
callvirt System.Void ab2.2J2::nC6()
nop <null>
ret <null>
Module Name
oNhln9lq3i
Full Name
oNhln9lq3i
EntryPoint
System.Void 74V.PEs::627()
Scope Name
oNhln9lq3i
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DB9farRJATwBRmyX
Assembly Version
6.7.3.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1779
Main Method
System.Void 74V.PEs::627()
Main IL Instruction Count
5
Main IL 
nop <null>
ldsfld ab2.2J2 74V.PEs::792
callvirt System.Void ab2.2J2::nC6()
nop <null>
ret <null>
361c7e66254b49f2f0bf864e13c89b8e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙