Deep Malware Analysis of 4a3b6ba6129be3ac63ec47f414a39d97 | md5: 4a3b6ba6129be3ac63ec47f414a39d97 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.77

PE Executable

MD5: 4a3b6ba6129be3ac63ec47f414a39d97

Size: 811.52 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	4a3b6ba6129be3ac63ec47f414a39d97
Sha1	d3ebff2740841addb241bee516946e4ad732099e
Sha256	268b6fdc221050949a2b624983380cd3fb268fecef2f5bb3a15d91611f3d8092
Sha384	4d7492dcfc98a764551f9b70eb6edb8f6350227b75d752cce345f57492429e961d18c11422fc2ed1d4d9f0e2354e7abb
Sha512	b4e63a6a270175dbee6db6b50aa23dd250500f6cb912d1ed4c4d03d938d9a7bd7bc2e4201f13b1e53dcfdd55a3a961fe59bb6beb38238a23dd340e47552c1d45
SSDeep	12288:uO2wT0OWTYcI1prLubfX0gulLXzlOZOYB3NTAwBEqZ/6TCsqzak/Y8+dYf1:u7wkI1x+8FLzlOZOg3NrBEqZyTCNG
TLSH	7105DF9C3250B49FC8A3C972CDA4DD74A6646CAA870BC20395D71D9FBD0E997DE102F2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	AmSv.exe
Full Name	AmSv.exe
EntryPoint	System.Void CSVViewer.Program::Main()
Scope Name	AmSv.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AmSv
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	183
Main Method	System.Void CSVViewer.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> call System.Void CSVViewer.Program::‮‎‍⁭‮⁯⁫‫‪‫‫‬⁭⁫‎‪‏‪‬‎‫⁫⁪‍‮‬‌‌‍⁪⁫⁪⁭‮‎‍⁬‮() ldc.i4 -433697858 ldc.i4 -1044313795 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_005D: ret nop <null> ldc.i4.0 <null> call System.Void CSVViewer.Program::‭‭‭‎⁫⁬‮⁯‭‎⁪⁮‬‍‭‬‎⁯‎‏‪‍‬‎‌⁫⁬⁫‪‍⁬‎‪‫‍⁫⁭‮‬⁮‮(System.Boolean) ldloc.0 <null> ldc.i4 -848852018 mul <null> ldc.i4 -1951598134 xor <null> br.s IL_000B: ldc.i4 -1044313795 nop <null> newobj System.Void CSVViewer.Forms.MainForm::.ctor() call System.Void CSVViewer.Program::‍‎⁬⁬‏‍⁪‍⁮⁯⁪‮⁮⁯⁫⁯‭‍‌‍‭⁯‮‍⁫⁫⁭‭‭⁮‭⁪⁬⁫⁮⁬‌‌‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 1879619753 mul <null> ldc.i4 -802733878 xor <null> br.s IL_000B: ldc.i4 -1044313795 ret <null>
Module Name	AmSv.exe
Full Name	AmSv.exe
EntryPoint	System.Void CSVViewer.Program::Main()
Scope Name	AmSv.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AmSv
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	183
Main Method	System.Void CSVViewer.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> call System.Void CSVViewer.Program::‮‎‍⁭‮⁯⁫‫‪‫‫‬⁭⁫‎‪‏‪‬‎‫⁫⁪‍‮‬‌‌‍⁪⁫⁪⁭‮‎‍⁬‮() ldc.i4 -433697858 ldc.i4 -1044313795 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_005D: ret nop <null> ldc.i4.0 <null> call System.Void CSVViewer.Program::‭‭‭‎⁫⁬‮⁯‭‎⁪⁮‬‍‭‬‎⁯‎‏‪‍‬‎‌⁫⁬⁫‪‍⁬‎‪‫‍⁫⁭‮‬⁮‮(System.Boolean) ldloc.0 <null> ldc.i4 -848852018 mul <null> ldc.i4 -1951598134 xor <null> br.s IL_000B: ldc.i4 -1044313795 nop <null> newobj System.Void CSVViewer.Forms.MainForm::.ctor() call System.Void CSVViewer.Program::‍‎⁬⁬‏‍⁪‍⁮⁯⁪‮⁮⁯⁫⁯‭‍‌‍‭⁯‮‍⁫⁫⁭‭‭⁮‭⁪⁬⁫⁮⁬‌‌‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 1879619753 mul <null> ldc.i4 -802733878 xor <null> br.s IL_000B: ldc.i4 -1044313795 ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.