Suspicious
Suspect

PE Executable
MD5: 4fbcbc302467470ed9063b56569dc493
Size: 724.99 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 4fbcbc302467470ed9063b56569dc493
Sha1 70f0bed15fe4b4e927bf27e38ae12e676c1d5c6a
Sha256 8f4137c1511c9ef89a6fe06bd7a2e0ca79c0306775cdc3e8fb3a603c01ab53bf
Sha384 563a012ab71c5ced6506bf835f80fb13f36dfc26d57f7689e4159a1b34de748933f13d9dccb3876509c543393dfd2387
Sha512 119e3ff9d2ad738c45308df8ec306387ee257a2148b4768169716ab6580961c53ae4d888a1b8b947dcffb332b8d90a99d5579f9171d592fa28918cf770f45269
SSDeep 12288:ygeu+RZNlb8Zja1tYR8ENWO3SqS2aS4mU2WSLoTWOL3o6Ge4hpO0M39yu:NzivbIja1tYR8ENz3SqPaDSLsxL3o6l3
TLSH 19F41274370AE911C8D95BB298A2C3B75279DFDCB023D31389EEBDD3B529B163598240
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4fbcbc302467470ed9063b56569dc493
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CatFeeder.Properties.Resources.resources
VoLt
[NBF]root.Data
[NBF]root.Data-preview.png
cgi
[NBF]root.Data
Name Value
Module Name
dgbU.exe
Full Name
dgbU.exe
EntryPoint
System.Void CatFeeder.Program::Main()
Scope Name
dgbU.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dgbU
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
91
Main Method
System.Void CatFeeder.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CatFeeder.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
dgbU.exe
Full Name
dgbU.exe
EntryPoint
System.Void CatFeeder.Program::Main()
Scope Name
dgbU.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dgbU
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
91
Main Method
System.Void CatFeeder.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CatFeeder.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
dghuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4fbcbc302467470ed9063b56569dc493
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CatFeeder.Properties.Resources.resources
VoLt
[NBF]root.Data
[NBF]root.Data-preview.png
cgi
[NBF]root.Data
No malware configuration was found at this point.
PDB Path PATH
dghuhuhuhu
4fbcbc302467470ed9063b56569dc493
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙