Suspicious
Suspect

PE Executable
MD5: 479c75d82ef23856840bd12218e1b4c5
Size: 956.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 479c75d82ef23856840bd12218e1b4c5
Sha1 6ebd6bbe27a35a67366e70b924c1521a1996828a
Sha256 81b19f8611103172377c688fb97b10620699c66fc7f207b4dcd01ec89ba07bee
Sha384 a76ea6b5426e4712d5347cffa7feb8ea53499cdd9d8d981e87eea4f0fb30a4b5b4bcd20fd7c8f6cfba3fbf29a197f106
Sha512 30235a9ad0f1b628a6ad30a329499470ac5bbe82b8f1ca04c614072d38d41645f94a9b18d4ebd1c5b511614cb96c1b72d0e125b4b333c989c6df2d51859568f3
SSDeep 12288:gHNilfyO0EZPy5E1Z1IaqHcvVnaXujgZ/CbmapHIuj0dK1lfwPHa05LxZlvxZWmk:eNmxaZ/CK+HRj0dKLfhMNv7Pcr
TLSH 2B15E0225F466B99D6AE0F78C0660C6C37F8C9076392E61B2FED40F59EB3B94C917052
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
479c75d82ef23856840bd12218e1b4c5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1EogDba6x3iCwX.Resources.resources
1EogDba6x3iCwX.g.resources
1cbca1cda49a53.Resources.resources
1a22b2070
[NBF]root.Data
1a22b2071
[NBF]root.Data
1a22b2072
[NBF]root.Data
1a22b2073
[NBF]root.Data
1a22b2074
[NBF]root.Data
1a22b2075
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
1EogDba6x3iCwX
Full Name
1EogDba6x3iCwX
EntryPoint
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Scope Name
1EogDba6x3iCwX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1EogDba6x3iCwX
Assembly Version
16.28.42.71
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Main IL Instruction Count
102
Main IL 
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldc.i4.5 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
ldc.i4.4 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
br.s IL_006E: br.s IL_0070
br.s IL_0070: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_5
ldloc.s V_5
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0090: nop
nop <null>
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void Je1x2sa.zDd05fN::Rg5n8iiDdrJ(System.Object)
nop <null>
leave.s IL_00D4: br.s IL_00D6
br.s IL_00A5: br.s IL_00A7
br.s IL_00A7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
nop <null>
ldloc.1 <null>
nop <null>
ldc.i4.2 <null>
ldc.i8 3
ldc.i4 340205849
call System.String tLg63ibQNg.rs5WXad09nGjJ/bLn0d5Bq6.tCz4ge3PmDc1/Tiz9kW4kM.Agk63Faof4C::7AmdwxQ0mN1fKo(System.Int32,System.Int64,System.Int32)
call System.Void Zx2qf9iB7A.6ctMX4sf::3Gpqgt2SZ5df4(System.Exception,System.String)
br.s IL_00CC: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D4: br.s IL_00D6
br.s IL_00D6: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00F6: leave.s IL_014E
leave.s IL_014E: br.s IL_0150
br.s IL_00FA: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_9
ldloc.s V_9
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_011E: nop
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::remove_ThreadException(System.Threading.ThreadExceptionEventHandler)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::remove_UnhandledException(System.UnhandledExceptionEventHandler)
ldc.i4.2 <null>
stloc.s V_9
br.s IL_00FD: ldloc.s V_9
nop <null>
endfinally <null>
br.s IL_0150: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0170: nop
nop <null>
ret <null>
ldtoken System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
pop <null>
ret <null>
Module Name
1EogDba6x3iCwX
Full Name
1EogDba6x3iCwX
EntryPoint
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Scope Name
1EogDba6x3iCwX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1EogDba6x3iCwX
Assembly Version
16.28.42.71
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Main IL Instruction Count
102
Main IL 
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldc.i4.5 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
ldc.i4.4 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
br.s IL_006E: br.s IL_0070
br.s IL_0070: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_5
ldloc.s V_5
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0090: nop
nop <null>
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void Je1x2sa.zDd05fN::Rg5n8iiDdrJ(System.Object)
nop <null>
leave.s IL_00D4: br.s IL_00D6
br.s IL_00A5: br.s IL_00A7
br.s IL_00A7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
nop <null>
ldloc.1 <null>
nop <null>
ldc.i4.2 <null>
ldc.i8 3
ldc.i4 340205849
call System.String tLg63ibQNg.rs5WXad09nGjJ/bLn0d5Bq6.tCz4ge3PmDc1/Tiz9kW4kM.Agk63Faof4C::7AmdwxQ0mN1fKo(System.Int32,System.Int64,System.Int32)
call System.Void Zx2qf9iB7A.6ctMX4sf::3Gpqgt2SZ5df4(System.Exception,System.String)
br.s IL_00CC: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D4: br.s IL_00D6
br.s IL_00D6: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00F6: leave.s IL_014E
leave.s IL_014E: br.s IL_0150
br.s IL_00FA: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_9
ldloc.s V_9
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_011E: nop
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::remove_ThreadException(System.Threading.ThreadExceptionEventHandler)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::remove_UnhandledException(System.UnhandledExceptionEventHandler)
ldc.i4.2 <null>
stloc.s V_9
br.s IL_00FD: ldloc.s V_9
nop <null>
endfinally <null>
br.s IL_0150: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0170: nop
nop <null>
ret <null>
ldtoken System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
pop <null>
ret <null>
479c75d82ef23856840bd12218e1b4c5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1EogDba6x3iCwX.Resources.resources
1EogDba6x3iCwX.g.resources
1cbca1cda49a53.Resources.resources
1a22b2070
[NBF]root.Data
1a22b2071
[NBF]root.Data
1a22b2072
[NBF]root.Data
1a22b2073
[NBF]root.Data
1a22b2074
[NBF]root.Data
1a22b2075
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙