Suspicious
Suspect

PE Executable
MD5: 43436f5091c8c7efa5c232ad85249b34
Size: 1.85 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 43436f5091c8c7efa5c232ad85249b34
Sha1 5c4a94a4da67cf7752690f8ff2ff9014b9d6ee02
Sha256 5d6b6bcd74ed29295040fe1622bd3c681fe2b729eaa9f24b4538d1db6eb2e3e3
Sha384 873143b8bbabb3e6102ce018f0c2ff8ca3def5c818da5dfc8365a83d15311c3f83aff4e7c74dcb747323df32f53186cc
Sha512 68241195c3953eb796f069730482bb16232d24e1b658167682fcd04ff720cd466cdabc6e032bec3f74d606cb11d0df2cf66da9406947b877a914b1ca80f9c2e7
SSDeep 49152:TbUTabrTAhruWZ582lL4a/BFf8WXndnUtfY1nYJAKJcPS:Toabyq+/lL443f8WNRnYJ3cPS
TLSH 348533EAB191D28ECEB1DEBBDC227C411E406D636B54C016B57A32D790127B727EA06C
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
43436f5091c8c7efa5c232ad85249b34
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
Name Value
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr hMD4zKeG0YLyO+gDPN0Csw==
ldstr X5I7UMxJQ0lYTH96Xg6XXA0wgLZq8/86L5V/m3U48jM=
ldstr nEwdu0kvvSFgPw0s90FEVA==
call System.String ᳉୭べ緘߅䏅᭷皷菷㷷::塛⅟�∸䇵ඒ拿愚(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void a.a::Main()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void a.a::Main()
Main IL Instruction Count
37
Main IL 
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr hMD4zKeG0YLyO+gDPN0Csw==
ldstr X5I7UMxJQ0lYTH96Xg6XXA0wgLZq8/86L5V/m3U48jM=
ldstr nEwdu0kvvSFgPw0s90FEVA==
call System.String ᳉୭べ緘߅䏅᭷皷菷㷷::塛⅟�∸䇵ඒ拿愚(System.String,System.String,System.String)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave IL_0046: ldloc.1
ldloc.2 <null>
brfalse IL_0045: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave IL_0070: ret
ldloc.0 <null>
brfalse IL_006F: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ret <null>
43436f5091c8c7efa5c232ad85249b34
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙