Suspicious
Suspect

365ee6e8dcf91e5ce031b643a8c4ff08

PE Executable
MD5: 365ee6e8dcf91e5ce031b643a8c4ff08
Size: 6.16 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 365ee6e8dcf91e5ce031b643a8c4ff08
Sha1 ab42878a591681f9e38f01151f63da00eee3124a
Sha256 a44c6ec422496a206cc382544413dbd9bdf293a07ff60fe32dfd2055f357bd31
Sha384 7648403f0fa5d15e2e825c18686b2b9b7cc9274eb4567f4a6c1e760abb67e9925021e1a6566957cfeb7a27fc626d3412
Sha512 d3c43f4af97a937cbdac598d1e3b62ae90a9bc94047b8ff3c483d38d0341e79078adf25e4370ef2521ff8f768644421aac4c0a9fe1b2491372df73b367c3750b
SSDeep 49152:2su4cj9OMzVFopCykgptoi8zbi5/V1OhJ4uPZ2KtwCJZ0TjzUPD2iFKLyedRZczZ:2r4ckMzVFopCykIIhJFMGKLymsc
TLSH DE569D04BBF85E2AD07FC675D4B14012A3F0F85EB323DB9F1A8196792E23B809915767
365ee6e8dcf91e5ce031b643a8c4ff08
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Prisma.Common.WalletCrack.bip39-english.txt
H264SharpNative-win64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
openh264-2.4.1-win64.dll
[Authenticode]_33633641.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rodata
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Prisma.Client.Properties.Resources.resources
NAudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.WinMM.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
HvncHook32.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.reloc
HvncHook64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
HvncInject64.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
ILRepack.List
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 2secondary ignored: 4
bin 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Path pe:exe>pe:exe
Shape pe:exe>pe:exe
2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
client
Full Name
client
EntryPoint
System.Void Prisma.Client.Program::Main(System.String[])
Scope Name
client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
15864
Main Method
System.Void Prisma.Client.Program::Main(System.String[])
Main IL Instruction Count
71
Main IL 
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0042: ldloca.s V_0
call System.Boolean Prisma.Client.Program::AllocConsole()
pop <null>
ldstr Prisma Debug Terminal
call System.Boolean Prisma.Client.Program::SetConsoleTitle(System.String)
pop <null>
ldc.i4.s 10
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr === PRISMA DEBUG TERMINAL ===
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldstr Process started: 
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.String::Concat(System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldloca.s V_0
call System.Boolean Prisma.Client.Program::IsRestartLooping(System.String&)
brfalse.s IL_0084: ldc.i4 3072
ldstr BLOCKED: restart loop detected — 
ldloc.0 <null>
ldstr . Exiting.
call System.String System.String::Concat(System.String,System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0083: ret
ldc.i4.s 12
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr Press any key to close...
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_00C4: ldc.i4.2
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadExceptionDebug(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledExceptionDebug(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
br.s IL_00F1: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadException(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldstr Starting PrismaApplication...
call System.Void Prisma.Client.Program::DbgLog(System.String)
newobj System.Void Prisma.Client.PrismaApplication::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldstr PrismaApplication exited.
call System.Void Prisma.Client.Program::DbgLog(System.String)
ret <null>
365ee6e8dcf91e5ce031b643a8c4ff08
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Prisma.Common.WalletCrack.bip39-english.txt
H264SharpNative-win64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
openh264-2.4.1-win64.dll
[Authenticode]_33633641.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rodata
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Prisma.Client.Properties.Resources.resources
NAudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.WinMM.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
HvncHook32.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.reloc
HvncHook64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
HvncInject64.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙