Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 479c75d82ef23856840bd12218e1b4c5
Size: 956.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 479c75d82ef23856840bd12218e1b4c5
Sha1 6ebd6bbe27a35a67366e70b924c1521a1996828a
Sha256 81b19f8611103172377c688fb97b10620699c66fc7f207b4dcd01ec89ba07bee
Sha384 a76ea6b5426e4712d5347cffa7feb8ea53499cdd9d8d981e87eea4f0fb30a4b5b4bcd20fd7c8f6cfba3fbf29a197f106
Sha512 30235a9ad0f1b628a6ad30a329499470ac5bbe82b8f1ca04c614072d38d41645f94a9b18d4ebd1c5b511614cb96c1b72d0e125b4b333c989c6df2d51859568f3
SSDeep 12288:gHNilfyO0EZPy5E1Z1IaqHcvVnaXujgZ/CbmapHIuj0dK1lfwPHa05LxZlvxZWmk:eNmxaZ/CK+HRj0dKLfhMNv7Pcr
TLSH 2B15E0225F466B99D6AE0F78C0660C6C37F8C9076392E61B2FED40F59EB3B94C917052
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
479c75d82ef23856840bd12218e1b4c5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1EogDba6x3iCwX.Resources.resources
1EogDba6x3iCwX.g.resources
1cbca1cda49a53.Resources.resources
1a22b2070
[NBF]root.Data
1a22b2071
[NBF]root.Data
1a22b2072
[NBF]root.Data
1a22b2073
[NBF]root.Data
1a22b2074
[NBF]root.Data
1a22b2075
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
1EogDba6x3iCwX
Full Name
1EogDba6x3iCwX
EntryPoint
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Scope Name
1EogDba6x3iCwX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1EogDba6x3iCwX
Assembly Version
16.28.42.71
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Main IL Instruction Count
102
Main IL 
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldc.i4.5 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
ldc.i4.4 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
br.s IL_006E: br.s IL_0070
br.s IL_0070: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_5
ldloc.s V_5
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0090: nop
nop <null>
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void Je1x2sa.zDd05fN::Rg5n8iiDdrJ(System.Object)
nop <null>
leave.s IL_00D4: br.s IL_00D6
br.s IL_00A5: br.s IL_00A7
br.s IL_00A7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
nop <null>
ldloc.1 <null>
nop <null>
ldc.i4.2 <null>
ldc.i8 3
ldc.i4 340205849
call System.String tLg63ibQNg.rs5WXad09nGjJ/bLn0d5Bq6.tCz4ge3PmDc1/Tiz9kW4kM.Agk63Faof4C::7AmdwxQ0mN1fKo(System.Int32,System.Int64,System.Int32)
call System.Void Zx2qf9iB7A.6ctMX4sf::3Gpqgt2SZ5df4(System.Exception,System.String)
br.s IL_00CC: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D4: br.s IL_00D6
br.s IL_00D6: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00F6: leave.s IL_014E
leave.s IL_014E: br.s IL_0150
br.s IL_00FA: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_9
ldloc.s V_9
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_011E: nop
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::remove_ThreadException(System.Threading.ThreadExceptionEventHandler)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::remove_UnhandledException(System.UnhandledExceptionEventHandler)
ldc.i4.2 <null>
stloc.s V_9
br.s IL_00FD: ldloc.s V_9
nop <null>
endfinally <null>
br.s IL_0150: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0170: nop
nop <null>
ret <null>
ldtoken System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
pop <null>
ret <null>
Module Name
1EogDba6x3iCwX
Full Name
1EogDba6x3iCwX
EntryPoint
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Scope Name
1EogDba6x3iCwX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1EogDba6x3iCwX
Assembly Version
16.28.42.71
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
Main IL Instruction Count
102
Main IL 
ldc.i4.0 <null>
stloc.3 <null>
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldc.i4.5 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
ldc.i4.4 <null>
stloc.3 <null>
br.s IL_0002: ldloc.3
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
br.s IL_006E: br.s IL_0070
br.s IL_0070: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_5
ldloc.s V_5
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0090: nop
nop <null>
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void Je1x2sa.zDd05fN::Rg5n8iiDdrJ(System.Object)
nop <null>
leave.s IL_00D4: br.s IL_00D6
br.s IL_00A5: br.s IL_00A7
br.s IL_00A7: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
nop <null>
ldloc.1 <null>
nop <null>
ldc.i4.2 <null>
ldc.i8 3
ldc.i4 340205849
call System.String tLg63ibQNg.rs5WXad09nGjJ/bLn0d5Bq6.tCz4ge3PmDc1/Tiz9kW4kM.Agk63Faof4C::7AmdwxQ0mN1fKo(System.Int32,System.Int64,System.Int32)
call System.Void Zx2qf9iB7A.6ctMX4sf::3Gpqgt2SZ5df4(System.Exception,System.String)
br.s IL_00CC: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D4: br.s IL_00D6
br.s IL_00D6: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00F6: leave.s IL_014E
leave.s IL_014E: br.s IL_0150
br.s IL_00FA: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_9
ldloc.s V_9
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_011E: nop
nop <null>
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::wLg74s(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::remove_ThreadException(System.Threading.ThreadExceptionEventHandler)
nop <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Zx2qf9iB7A.6ctMX4sf::Rf9wf3Bq0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::remove_UnhandledException(System.UnhandledExceptionEventHandler)
ldc.i4.2 <null>
stloc.s V_9
br.s IL_00FD: ldloc.s V_9
nop <null>
endfinally <null>
br.s IL_0150: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0170: nop
nop <null>
ret <null>
ldtoken System.Void Zx2qf9iB7A.6ctMX4sf::Ckp0gx7()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙