411d4a442778e2baa60aa76a64c2941b

PE Executable

MD5: 411d4a442778e2baa60aa76a64c2941b

Size: 929.28 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

929.28 KB · 929,280 B

Hashes

MD5 411d4a442778e2baa60aa76a64c2941b Sha1 7a3f568f0a028a4e3a64a39b8b03be6bab514b20 Sha256 ce8bc1799108673f0b2c4eadbdfbeefcb6c452934be4c26a88c257a6737bc5be Sha384 4de24ea084a41157840311eba68ed9c0c9cdbb11b4534e2cf1a810b3bcc3a18e3aecf43125698c56c4f1884c21329072 Sha512 b2b11509aa3f93973dcdc43291ca69f54115fd36ff627e342141d0d028c4365c272eea54be7a802990bdb0ab802991ddc1f6c89d31096fb465bb71ca22c902e2 SSDeep 24576:axemMcxMdXgzPHzO4z0hn6NAPPgXLbnS5C:axemfgw7HzD+PPsS5 TLSH D21501682A16EA16C86453740BB2F2B413BD6EDDB811D2125FE9BEDF7E32F419C04253

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Low

8 files

EXE411d4a442778e2baa60aa76a64c2941b

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

BIN.Net Resources

BINWhiskeyWarehouse.Properties.Resources.resources

BINClhW

DATA[NBF]root.Data

BINTissue

DATA[NBF]root.Data

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Module Name	XRKr.exe
Full Name	XRKr.exe
EntryPoint	System.Void WhiskeyWarehouse.Program::Main()
Scope Name	XRKr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XRKr
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	390
Main Method	System.Void WhiskeyWarehouse.Program::Main()
Main IL Instruction Count	12
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> call System.Void WhiskeyWarehouse.VarastoRepository::InitializeData() nop <null> newobj System.Void WhiskeyWarehouse.FormaVarasto::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`
Module Name	XRKr.exe
Full Name	XRKr.exe
EntryPoint	System.Void WhiskeyWarehouse.Program::Main()
Scope Name	XRKr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XRKr
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	390
Main Method	System.Void WhiskeyWarehouse.Program::Main()
Main IL Instruction Count	12
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> call System.Void WhiskeyWarehouse.VarastoRepository::InitializeData() nop <null> newobj System.Void WhiskeyWarehouse.FormaVarasto::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

8 files

EXE411d4a442778e2baa60aa76a64c2941b

Structure

BINResources

BIN.Net Resources

No malware configuration was found at this point.

You must be signed in to view YARA rules.