Deep Malware Analysis of 3d8571f6b73b3a2c81742f1ebf74c2d3 | md5: 3d8571f6b73b3a2c81742f1ebf74c2d3 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.78

PE Executable

MD5: 3d8571f6b73b3a2c81742f1ebf74c2d3

Size: 742.91 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	3d8571f6b73b3a2c81742f1ebf74c2d3
Sha1	bd43a63c5f3854ea4bb649e30d4fe4d44fbcdd7d
Sha256	57ddc71d4ceabf26512f5bf88152f41b543de6cc7080b8d5660c43badd4dbd4d
Sha384	97db5f79eb3c25160bd50c3aef101e320a98cbf7f2ce836c0f38dc083e05a179c2ff9265120de2ccb581353371a60868
Sha512	4b2b1e2ac3c4163663e47b26ea36053fc8b627e20f88f834f434c10a99ce130c65185a967885c954f91777c53a5f471f2378a2573f7793d4482ad1af02405864
SSDeep	12288:hRnwj8oSnVZoE2DzQAZ39U1Q4FAtsRO2X45Nchan217Lhp33jBes:0TSVZoTkA19CQ4WCVX
TLSH	43F4025C3151F46FC4A39E768CA4EE74D6396CAAA207C20391E72DDFBD0D682DE141E2

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	OxGX.exe
Full Name	OxGX.exe
EntryPoint	System.Void WorldClock.Program::Main()
Scope Name	OxGX.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	OxGX
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	165
Main Method	System.Void WorldClock.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> call System.Void WorldClock.Program::⁪⁭‭⁮‭‮‪⁪‪‌‏‮‌‭‪⁭‬⁪⁭‍⁭‪‫‪‭‪‬‌⁭‭⁫‫⁬‬⁪‎‏‮() nop <null> ldc.i4 550114778 ldc.i4 5554107 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0052: newobj System.Void WorldClock.Form1::.ctor() ldc.i4.0 <null> call System.Void WorldClock.Program::‍‌‎‫‪⁮⁪⁯‎‫‭‎‫‭‬‬‮‪⁬‎⁯‫⁭‮‌‌‭‭‭‬⁯⁯‪⁬‏‍⁮⁭⁪‮(System.Boolean) ldloc.0 <null> ldc.i4 -574693090 mul <null> ldc.i4 1899519650 xor <null> br.s IL_000C: ldc.i4 5554107 nop <null> ldloc.0 <null> ldc.i4 -963600132 mul <null> ldc.i4 1873922231 xor <null> br.s IL_000C: ldc.i4 5554107 newobj System.Void WorldClock.Form1::.ctor() call System.Void WorldClock.Program::⁭⁫⁬‮⁭⁯⁯⁫‍⁪⁭‫⁭‍‪⁯‏‭‬‬‌⁬‫‮‌‌‪⁭⁯‭⁮‬‫‭‏⁬‌‮(System.Windows.Forms.Form) nop <null> ret <null>
Module Name	OxGX.exe
Full Name	OxGX.exe
EntryPoint	System.Void WorldClock.Program::Main()
Scope Name	OxGX.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	OxGX
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	165
Main Method	System.Void WorldClock.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> call System.Void WorldClock.Program::⁪⁭‭⁮‭‮‪⁪‪‌‏‮‌‭‪⁭‬⁪⁭‍⁭‪‫‪‭‪‬‌⁭‭⁫‫⁬‬⁪‎‏‮() nop <null> ldc.i4 550114778 ldc.i4 5554107 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0052: newobj System.Void WorldClock.Form1::.ctor() ldc.i4.0 <null> call System.Void WorldClock.Program::‍‌‎‫‪⁮⁪⁯‎‫‭‎‫‭‬‬‮‪⁬‎⁯‫⁭‮‌‌‭‭‭‬⁯⁯‪⁬‏‍⁮⁭⁪‮(System.Boolean) ldloc.0 <null> ldc.i4 -574693090 mul <null> ldc.i4 1899519650 xor <null> br.s IL_000C: ldc.i4 5554107 nop <null> ldloc.0 <null> ldc.i4 -963600132 mul <null> ldc.i4 1873922231 xor <null> br.s IL_000C: ldc.i4 5554107 newobj System.Void WorldClock.Form1::.ctor() call System.Void WorldClock.Program::⁭⁫⁬‮⁭⁯⁯⁫‍⁪⁭‫⁭‍‪⁯‏‭‬‬‌⁬‫‮‌‌‪⁭⁯‭⁮‬‫‭‏⁬‌‮(System.Windows.Forms.Form) nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.