43acf807b990fdecf4df70cdecbae471

PE Executable

MD5: 43acf807b990fdecf4df70cdecbae471

Size: 5.25 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

5.25 MB · 5,248,512 B

Hashes

MD5 43acf807b990fdecf4df70cdecbae471 Sha1 239b44f5f940d97382514b8732dce753838b7290 Sha256 1a0d30a946baa3d276b81612c09e29474bced407760df0f5b8dac777c79e481d Sha384 bb238ea5960d20042ad796adc5d71b3eac4fb234294ea063fc4a0d3842a9344571c0814ddde1c51b8cad4ec768d3dde4 Sha512 ebde6f91ef8aadc1ce4a80ed5fa9b1b5666e35bbe08044a7f48bbf40754649afedbd3f75d62e6f3a81d1fd2ff0bd25e3c414ed99c50199c6b880d55ece11ae6d SSDeep 98304:aoqjKFwt0+MhgUPGcFe8O0ch/ic6W7tt5zjGyAzZvprcjDi:tq0uchgUE8MqcDhtrAtx TLSH 1C36334752833F7BE5DDA57830E73A5DACF2A38308949FE870E6DC74598B9E13496022

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

3 files

EXE43acf807b990fdecf4df70cdecbae471

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Module Name	DataClient.exe
Full Name	DataClient.exe
EntryPoint	System.Void Stub.Program::Main()
Scope Name	DataClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DataClient
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	13
Main Method	System.Void Stub.Program::Main()
Main IL Instruction Count	15
Info	PE Detect: PeReader OK (file layout)
Main IL	`call System.Void Stub.Program::VerifyLicense() call System.Void Stub.Program::ProcessJunk() ldsfld System.Byte[] Stub.Program::Enc ldstr YQobNu+1E4dkgM2fH2frUfb/Zf1vJwrReMidsf24xAQ= ldstr rSIotSEx8gc6h+tpHN+Ypg== call System.Byte[] Stub.Program::Decrypt(System.Byte[],System.String,System.String) stloc.0 <null> ldloc.0 <null> brfalse.s IL_0028: leave.s IL_002D ldloc.0 <null> call System.Void Stub.Program::Execute(System.Byte[]) leave.s IL_002D: ret pop <null> leave.s IL_002D: ret ret <null>`
Module Name	DataClient.exe
Full Name	DataClient.exe
EntryPoint	System.Void Stub.Program::Main()
Scope Name	DataClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DataClient
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	13
Main Method	System.Void Stub.Program::Main()
Main IL Instruction Count	15
Main IL	`call System.Void Stub.Program::VerifyLicense() call System.Void Stub.Program::ProcessJunk() ldsfld System.Byte[] Stub.Program::Enc ldstr YQobNu+1E4dkgM2fH2frUfb/Zf1vJwrReMidsf24xAQ= ldstr rSIotSEx8gc6h+tpHN+Ypg== call System.Byte[] Stub.Program::Decrypt(System.Byte[],System.String,System.String) stloc.0 <null> ldloc.0 <null> brfalse.s IL_0028: leave.s IL_002D ldloc.0 <null> call System.Void Stub.Program::Execute(System.Byte[]) leave.s IL_002D: ret pop <null> leave.s IL_002D: ret ret <null>`

3 files

EXE43acf807b990fdecf4df70cdecbae471

Structure

BINResources

No malware configuration was found at this point.

You must be signed in to view YARA rules.