Suspicious
Suspect

3dcd3e2a1919055bd32c83dab86da59e

PE Executable
MD5: 3dcd3e2a1919055bd32c83dab86da59e
Size: 207.36 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
207.36 KB · 207,360 B
Hashes
MD5 3dcd3e2a1919055bd32c83dab86da59e Sha1 896235eebadf15fb2fe4333e109b9c7d3e2b7432 Sha256 8258d0072d4ce97403d82e6560f46d9e135ff8783ed04409870ad7df03035953 Sha384 63d6fe3787a62edb0742ebb3691ef374d67021f56dcee351a423af4998701cac3bcf9acf462beae2a8fd55acf0a8e598 Sha512 b0d747719351edb6352cfa1d59476dc12af57d723a6b5a657d576d99a81799bf3a7d57f54c5815b6f98a2557ddd9f6d0806e405d6382abf6bd275ddf5c362dd2 SSDeep 6144:QLV6Bta6dtJmakIM5EFmHi8ieZv00yRQ+E2cP:QLV6Btpmk/FmC83KWH2cP TLSH F814CF1637A9462FE2DE86BDA1220202937DC2E7A8C3F3DB2CD455B65F563E10A471D3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
4 files
EXE3dcd3e2a1919055bd32c83dab86da59e
Structure
BINResources
BINRT_RCDATA
BINID:0001
BINID:0
BIN.Net Resources
BINClientLoaderForm.resources
BIN          
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
4 files
EXE3dcd3e2a1919055bd32c83dab86da59e
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙