4767403688d692546776f0df2f48eba9

PE Executable

MD5: 4767403688d692546776f0df2f48eba9

Size: 1.17 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	4767403688d692546776f0df2f48eba9
Sha1	244fa92a5772679aeb2f76820cb16681426c8cba
Sha256	768b88bc6ad07b97723c930a5e63ffdaeb00dc3f7c2b38d99b08eeccc1df32a3
Sha384	a3cb69147b43c28a7b67a23854195c00a0d79aaea398befbcb2583ce9cad118d479df68fe6075b8db78b01e1a0b97a4d
Sha512	bf1af286be0295c4bca3289a493ab87d847ec18c02c21e0140e82e31efa241d860e10bee054a43aa838958fc3d437b0ed5f4757e8ebc8c17949650b3da06b269
SSDeep	24576:3WWeSH2c511fHnAG1Z9oSUnvUigB2fFeWRw4fbUUReeP95MEeRWOhg:mWHBHnTZ9oSUv24Hm+UPeXnGh
TLSH	E845E09C3215F89FC853CE718AA4EDB4A5206DA6930BC20395E72DEBB91D1C79E141F3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Module Name	tRnI.exe
Full Name	tRnI.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	tRnI.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tRnI
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	25
Main IL	nop <null> call System.Void RegenGarten.Program::⁪⁪⁭⁯‌‭‎‏‭‍‏⁮⁮⁫⁭⁭‎‮⁬‎‫‪⁭‎‌‬‪‌‌‏‮‎‍⁬‏⁫⁬‌‮() nop <null> ldc.i4.0 <null> call System.Void RegenGarten.Program::‭⁭‏‮‏‌‌⁫‎‬⁫‫‍⁭‭‮‍‮‫‌‫‌⁮⁬‪‏‍⁭‎‪‍⁪‮‫‫‌⁫‮(System.Boolean) nop <null> newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::⁪⁬‬‌⁫⁬‪‭⁫‎‌‍‫‎‍‭⁯⁭‬⁯⁮‫⁫‬⁮⁪‫‪⁮⁯‎⁪‭‏‫‬‮(System.Windows.Forms.Form) ldc.i4 -1849429535 ldc.i4 -1486857705 xor <null> dup <null> stloc.0 <null> ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_004A: ret nop <null> ldloc.0 <null> ldc.i4 -1424294291 mul <null> ldc.i4 -1528070125 xor <null> br.s IL_001D: ldc.i4 -1486857705 ret <null>
Module Name	tRnI.exe
Full Name	tRnI.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	tRnI.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tRnI
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	25
Main IL	nop <null> call System.Void RegenGarten.Program::⁪⁪⁭⁯‌‭‎‏‭‍‏⁮⁮⁫⁭⁭‎‮⁬‎‫‪⁭‎‌‬‪‌‌‏‮‎‍⁬‏⁫⁬‌‮() nop <null> ldc.i4.0 <null> call System.Void RegenGarten.Program::‭⁭‏‮‏‌‌⁫‎‬⁫‫‍⁭‭‮‍‮‫‌‫‌⁮⁬‪‏‍⁭‎‪‍⁪‮‫‫‌⁫‮(System.Boolean) nop <null> newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::⁪⁬‬‌⁫⁬‪‭⁫‎‌‍‫‎‍‭⁯⁭‬⁯⁮‫⁫‬⁮⁪‫‪⁮⁯‎⁪‭‏‫‬‮(System.Windows.Forms.Form) ldc.i4 -1849429535 ldc.i4 -1486857705 xor <null> dup <null> stloc.0 <null> ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_004A: ret nop <null> ldloc.0 <null> ldc.i4 -1424294291 mul <null> ldc.i4 -1528070125 xor <null> br.s IL_001D: ldc.i4 -1486857705 ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.