Suspicious
Suspect

PE Executable
MD5: 52f701f80353a1d6af46b8af77bceca8
Size: 805.38 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 52f701f80353a1d6af46b8af77bceca8
Sha1 5e53acf67dc5784627ec5e2f4b08c4f8654f222a
Sha256 2d80a9e5f2d7d40da131a8ed7ea8b67a25ff001263bec22589bfbaae4b89e963
Sha384 3123f0f74c3c13e73f395fdd0b82ca6eceb7eec52c7d82d9ff6e78fd6204be55061545654f37c5b9947c1f1530d0b7ce
Sha512 14ad2f95c280e1d4f80e29ed632cd351e5051bb56b76cfd12b5d5cae827f3d56a1543ae1891eeda9d7d248d5e65a17106fa210707c45ccbf766b3be62045e0f4
SSDeep 12288:vYs8r5p3hWg0fN8w6ZD5Ww702NUAHKbNCX0WT0D88NoV0NW+LlzumHx3RuollU:z8fZNC8ZHKJCX0fI8mVS7lKiU
TLSH 7805CF0723D44A6CE5BD9779846A44D147FFBB42AB32EB0DAD0A50EB1D26B51CF40B23
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
52f701f80353a1d6af46b8af77bceca8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
BargainingPlat.temona.json
jDc0B.Resources.resources
a955244cb73c4f.Resources.resources
47ea747c0
[NBF]root.Data
47ea747c1
[NBF]root.Data
47ea747c2
[NBF]root.Data
47ea747c3
[NBF]root.Data
47ea747c4
[NBF]root.Data
47ea747c5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
jDc0B
Full Name
jDc0B
EntryPoint
System.Void jDc0B.9akJr1NeC::kc2QHdj01Togm()
Scope Name
jDc0B
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
jDc0B
Assembly Version
17.15.44.238
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
815
Main Method
System.Void jDc0B.9akJr1NeC::kc2QHdj01Togm()
Main IL Instruction Count
121
Main IL 
nop <null>
nop <null>
ldstr EU-EN1749
stloc.0 <null>
ldc.i4 30000
stloc.1 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.2 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_12
ldloc.s V_12
ldstr Floors
ldc.i4.s 12
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
ldstr YearBuilt
ldc.i4 2018
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
ldstr EnergyRating
ldstr B+
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
stloc.3 <null>
ldc.i4.s 20
stloc.s V_4
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_5
ldloc.s V_4
stloc.s V_13
ldc.i4.1 <null>
stloc.s V_14
br.s IL_0085: ldloc.s V_14
ldloc.s V_5
ldloc.s V_14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_14
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ble.s IL_0075: ldloc.s V_5
ldstr FacilityOptima.Core
stloc.s V_6
ldstr 2.4.1
stloc.s V_7
call System.Guid System.Guid::NewGuid()
stloc.s V_15
ldloca.s V_15
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.s 12
callvirt System.String System.String::Substring(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_5
callvirt System.Int32 System.Collections.Generic.List`1<System.Int32>::get_Count()
ldloc.s V_4
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00D2: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_9
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr FacilityOptima
ldstr Cache
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_10
ldloc.s V_10
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0107: nop
ldloc.s V_10
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
nop <null>
call System.Int32 System.Environment::get_TickCount()
conv.i8 <null>
stloc.s V_11
ldc.i4.s 40
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldstr temona.json
call System.Void jDc0B.wKc4e/Ddj06Hw.9yfFoBe10mE::6LqnKpm03Jno(System.String)
nop <null>
call System.Void System.GC::Collect()
nop <null>
call System.Void System.GC::WaitForPendingFinalizers()
nop <null>
leave.s IL_0145: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0145: nop
nop <null>
ret <null>
Module Name
jDc0B
Full Name
jDc0B
EntryPoint
System.Void jDc0B.9akJr1NeC::kc2QHdj01Togm()
Scope Name
jDc0B
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
jDc0B
Assembly Version
17.15.44.238
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
815
Main Method
System.Void jDc0B.9akJr1NeC::kc2QHdj01Togm()
Main IL Instruction Count
121
Main IL 
nop <null>
nop <null>
ldstr EU-EN1749
stloc.0 <null>
ldc.i4 30000
stloc.1 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.2 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_12
ldloc.s V_12
ldstr Floors
ldc.i4.s 12
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
ldstr YearBuilt
ldc.i4 2018
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
ldstr EnergyRating
ldstr B+
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_12
stloc.3 <null>
ldc.i4.s 20
stloc.s V_4
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_5
ldloc.s V_4
stloc.s V_13
ldc.i4.1 <null>
stloc.s V_14
br.s IL_0085: ldloc.s V_14
ldloc.s V_5
ldloc.s V_14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_14
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ble.s IL_0075: ldloc.s V_5
ldstr FacilityOptima.Core
stloc.s V_6
ldstr 2.4.1
stloc.s V_7
call System.Guid System.Guid::NewGuid()
stloc.s V_15
ldloca.s V_15
ldstr N
call System.String System.Guid::ToString(System.String)
ldc.i4.0 <null>
ldc.i4.s 12
callvirt System.String System.String::Substring(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_5
callvirt System.Int32 System.Collections.Generic.List`1<System.Int32>::get_Count()
ldloc.s V_4
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00D2: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_9
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr FacilityOptima
ldstr Cache
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_10
ldloc.s V_10
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0107: nop
ldloc.s V_10
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
nop <null>
call System.Int32 System.Environment::get_TickCount()
conv.i8 <null>
stloc.s V_11
ldc.i4.s 40
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldstr temona.json
call System.Void jDc0B.wKc4e/Ddj06Hw.9yfFoBe10mE::6LqnKpm03Jno(System.String)
nop <null>
call System.Void System.GC::Collect()
nop <null>
call System.Void System.GC::WaitForPendingFinalizers()
nop <null>
leave.s IL_0145: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0145: nop
nop <null>
ret <null>
52f701f80353a1d6af46b8af77bceca8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
BargainingPlat.temona.json
jDc0B.Resources.resources
a955244cb73c4f.Resources.resources
47ea747c0
[NBF]root.Data
47ea747c1
[NBF]root.Data
47ea747c2
[NBF]root.Data
47ea747c3
[NBF]root.Data
47ea747c4
[NBF]root.Data
47ea747c5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙