Suspicious
Suspect

376503b9592dfba219c5378a5961be33

PE Executable
MD5: 376503b9592dfba219c5378a5961be33
Size: 8.7 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 376503b9592dfba219c5378a5961be33
Sha1 06a472ceb395f2dd0208aaa95bcf68c35df5535b
Sha256 c462396719067866b8220128287df855aecf174b5870ec48da54577e52ec7dd2
Sha384 1f7e41cf36699cef00a3418060b13e12db71f0e5bc65cc6dd3b17bb211edcf1c3d3c75bc9764d64b086588d32fc8cdf6
Sha512 fb21dd5d8e71a3288721c338aaf834688a4c6bf6efe07262cf3307f0b735ac2edfe79ccc6021f77028e67238f0ba6d9eaca67efcd4d235ad413a944a110fc45f
SSDeep 96:zOE/HkpS2AVEoL2tP9J7mZXyt1oaxOC5wFAj3W3DQjNzNt:6E/kpS2oEoCMXXIB6gn
TLSH 5B02205463F9051AE2FB7F702DB647204B76FD52DA3AC76D1988001E1E61790CA72BB2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
376503b9592dfba219c5378a5961be33
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Module Name
CaseyFundingFileLinks.exe
Full Name
CaseyFundingFileLinks.exe
EntryPoint
System.Int32 Program::Main(System.String[])
Scope Name
CaseyFundingFileLinks.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CaseyFundingFileLinks
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
36
Main Method
System.Int32 Program::Main(System.String[])
Main IL Instruction Count
48
Main IL 
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_000D: ldarg.0
call System.Int32 Program::Install()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
dup <null>
brtrue.s IL_0019: callvirt System.String System.String::Trim()
pop <null>
ldstr 
callvirt System.String System.String::Trim()
stloc.0 <null>
ldloc.0 <null>
ldstr /uninstall
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0035: ldloc.0
call System.Int32 Program::Uninstall()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.0 <null>
ldstr /install
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004B: ldloc.0
call System.Int32 Program::Install()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.0 <null>
call System.Int32 Program::Open(System.String)
stloc.2 <null>
leave.s IL_0070: ldloc.2
stloc.1 <null>
ldstr Something went wrong:


ldloc.1 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldc.i4.s 16
call System.Void Program::Say(System.String,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.2 <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
CaseyFundingFileLinks.exe
Full Name
CaseyFundingFileLinks.exe
EntryPoint
System.Int32 Program::Main(System.String[])
Scope Name
CaseyFundingFileLinks.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CaseyFundingFileLinks
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
36
Main Method
System.Int32 Program::Main(System.String[])
Main IL Instruction Count
48
Main IL 
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_000D: ldarg.0
call System.Int32 Program::Install()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
dup <null>
brtrue.s IL_0019: callvirt System.String System.String::Trim()
pop <null>
ldstr 
callvirt System.String System.String::Trim()
stloc.0 <null>
ldloc.0 <null>
ldstr /uninstall
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0035: ldloc.0
call System.Int32 Program::Uninstall()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.0 <null>
ldstr /install
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004B: ldloc.0
call System.Int32 Program::Install()
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.0 <null>
call System.Int32 Program::Open(System.String)
stloc.2 <null>
leave.s IL_0070: ldloc.2
stloc.1 <null>
ldstr Something went wrong:


ldloc.1 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldc.i4.s 16
call System.Void Program::Say(System.String,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
stloc.2 <null>
leave.s IL_0070: ldloc.2
ldloc.2 <null>
ret <null>
376503b9592dfba219c5378a5961be33
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙