373024184789ac365d08a68045a0de4f

PE Executable

MD5: 373024184789ac365d08a68045a0de4f

Size: 4.62 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	373024184789ac365d08a68045a0de4f
Sha1	dff0fd4aa0420ae9bf9075725783bfed4acaefca
Sha256	f645b0d2a7e3e35d416f872354de833f73bafda3edcdf208176bcb172cb5eeae
Sha384	9d4ac018fd31170ebba5ceb430d16b3d9f6b6f6ab7d62a8a41ed3457150028c92a1eb1f2b814d4292364041264453729
Sha512	838405fac17e2ae19233f67111498bd73797c5ced3ebd0b595fab03a1ef7754b51aea9900bd1b22834f9cc4e8e99bdd1fc24968cd44d3e1bc4c603c8530472d1
SSDeep	98304:vHvHQHSjOsQK6FuCVpYY/WqmjiJ8kNwiVc:vmLsQJF5TpOqEinNB6
TLSH	D22633413BF85E76D97E8B3678B52792E3BB7966E236E76C0D40D4C84660BD4C806323

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Module Name	GansoDesktop.exe
Full Name	GansoDesktop.exe
EntryPoint	System.Int32 Program::Main(System.String[])
Scope Name	GansoDesktop.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	GansoDesktop
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Info	PE Detect: PeReader OK (file layout)
Total Strings	517
Main Method	System.Int32 Program::Main(System.String[])
Main IL Instruction Count	32
Main IL	call System.Boolean Native::SetProcessDPIAware() pop <null> ldc.i4.1 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldarg.0 <null> call System.Int32 Program::Run(System.String[]) stloc.1 <null> leave.s IL_004F: ldloc.1 stloc.0 <null> call System.String Program::get_Dir() ldstr error.log call System.String System.IO.Path::Combine(System.String,System.String) ldloc.0 <null> callvirt System.String System.Object::ToString() call System.Void System.IO.File::WriteAllText(System.String,System.String) leave.s IL_0035: ldarg.0 pop <null> leave.s IL_0035: ldarg.0 ldarg.0 <null> ldlen <null> conv.i4 <null> brtrue.s IL_004B: ldc.i4.1 ldloc.0 <null> callvirt System.String System.Exception::get_Message() ldstr Ganso de Desktop: erro call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldc.i4.1 <null> stloc.1 <null> leave.s IL_004F: ldloc.1 ldloc.1 <null> ret <null>
Module Name	GansoDesktop.exe
Full Name	GansoDesktop.exe
EntryPoint	System.Int32 Program::Main(System.String[])
Scope Name	GansoDesktop.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	GansoDesktop
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	517
Main Method	System.Int32 Program::Main(System.String[])
Main IL Instruction Count	32
Main IL	call System.Boolean Native::SetProcessDPIAware() pop <null> ldc.i4.1 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldarg.0 <null> call System.Int32 Program::Run(System.String[]) stloc.1 <null> leave.s IL_004F: ldloc.1 stloc.0 <null> call System.String Program::get_Dir() ldstr error.log call System.String System.IO.Path::Combine(System.String,System.String) ldloc.0 <null> callvirt System.String System.Object::ToString() call System.Void System.IO.File::WriteAllText(System.String,System.String) leave.s IL_0035: ldarg.0 pop <null> leave.s IL_0035: ldarg.0 ldarg.0 <null> ldlen <null> conv.i4 <null> brtrue.s IL_004B: ldc.i4.1 ldloc.0 <null> callvirt System.String System.Exception::get_Message() ldstr Ganso de Desktop: erro call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldc.i4.1 <null> stloc.1 <null> leave.s IL_004F: ldloc.1 ldloc.1 <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.