4662103e4344ae19b8037d324e46539c

PE Executable

MD5: 4662103e4344ae19b8037d324e46539c

Size: 1.06 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	4662103e4344ae19b8037d324e46539c
Sha1	9a7d1b1b4917769e55101f4d3daf08272ec90f2f
Sha256	cf22f9ec1c9f574b8281ee9c4bdb301be36ad83bbe6fa01c60b99b4e28a4acec
Sha384	8be159b1224d4e6a3776de1e6426ab9fc4c40581d2f070cd7d868feb198387700a243ebe1f17344869f48e668b9e9497
Sha512	dbbd106c000f23618fe02432a15f0c371172347f60802ef923d3bc6c8de97522699a4e0824c5de4f0f0ff7da0f5ec381f1e0c2c31a0a3534c2ebb31c233f6604
SSDeep	24576:dOS9gE6iSm0IfrdKVq6eaGxfAVmNGBFNCt3yyyA:HCmRrcq6eay4Vm8BFN4yA
TLSH	BC35BFE83300E49EC453CA758835DDB3A5226D6E8E1AC20B64E77E5F7D2E38749121E7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Module Name	JBtN.exe
Full Name	JBtN.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	JBtN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JBtN
Assembly Version	201.502.607.709
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	37
Main IL	nop <null> call System.Void RegenGarten.Program::‌⁫‏‎‏‬⁮‎‏⁬⁮‪⁭⁭⁭‍‮⁬‏⁪‪‎⁬⁬‬‌⁮⁮‪‍‮⁫‎⁬⁯‎‮() ldc.i4 -1040443850 ldc.i4 -146611235 xor <null> dup <null> stloc.0 <null> ldc.i4.5 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0070: ret newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::‌‫‏‫⁬‮‭‮‪⁮⁫⁬⁫⁬‭‌⁯‫‬‬⁪‍⁭‏‭⁮‫⁫‎‮⁭‮⁪‏⁪‫‬‪‫‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 -1270055638 mul <null> ldc.i4 -1864904826 xor <null> br.s IL_000B: ldc.i4 -146611235 ldc.i4.0 <null> call System.Void RegenGarten.Program::‌‏‌⁯‮⁯‮‭‎⁬⁬‌⁬‮⁮‎‪⁫‏‍‌⁮⁭‪‍⁬⁬⁯‮‮⁪⁪‎‮‪‮‎‬‮‎‮(System.Boolean) nop <null> ldloc.0 <null> ldc.i4 988406087 mul <null> ldc.i4 384078402 xor <null> br.s IL_000B: ldc.i4 -146611235 nop <null> ldloc.0 <null> ldc.i4 -365241169 mul <null> ldc.i4 -1112970096 xor <null> br.s IL_000B: ldc.i4 -146611235 ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	JBtN.exe
Full Name	JBtN.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	JBtN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JBtN
Assembly Version	201.502.607.709
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	37
Main IL	nop <null> call System.Void RegenGarten.Program::‌⁫‏‎‏‬⁮‎‏⁬⁮‪⁭⁭⁭‍‮⁬‏⁪‪‎⁬⁬‬‌⁮⁮‪‍‮⁫‎⁬⁯‎‮() ldc.i4 -1040443850 ldc.i4 -146611235 xor <null> dup <null> stloc.0 <null> ldc.i4.5 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0070: ret newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::‌‫‏‫⁬‮‭‮‪⁮⁫⁬⁫⁬‭‌⁯‫‬‬⁪‍⁭‏‭⁮‫⁫‎‮⁭‮⁪‏⁪‫‬‪‫‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 -1270055638 mul <null> ldc.i4 -1864904826 xor <null> br.s IL_000B: ldc.i4 -146611235 ldc.i4.0 <null> call System.Void RegenGarten.Program::‌‏‌⁯‮⁯‮‭‎⁬⁬‌⁬‮⁮‎‪⁫‏‍‌⁮⁭‪‍⁬⁬⁯‮‮⁪⁪‎‮‪‮‎‬‮‎‮(System.Boolean) nop <null> ldloc.0 <null> ldc.i4 988406087 mul <null> ldc.i4 384078402 xor <null> br.s IL_000B: ldc.i4 -146611235 nop <null> ldloc.0 <null> ldc.i4 -365241169 mul <null> ldc.i4 -1112970096 xor <null> br.s IL_000B: ldc.i4 -146611235 ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.