Suspicious
Suspect

53325c85f989794efad017732bb2fca4

PE Executable
MD5: 53325c85f989794efad017732bb2fca4
Size: 3.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 53325c85f989794efad017732bb2fca4
Sha1 574419dc82f400a51b1b00c5518eff09fb102790
Sha256 f5e49e7ec748a0b4cfdecdddc5fdfaf9f5b7f38f73e962a4017b402ba8143d02
Sha384 94c4cf6a9ff6d55839de1306806cc9fcef2f55bc28224730327a785f9d38d6d49d4bff56a9b0a5fda49a3f19cc963739
Sha512 4ca6beac669d3d29ba35abf900dd1f01146c19ea2717d97fdf977adcde38043fb9c2649fa1e51ba2e17e5d7c94414c966cf8599d48735e39ca1ef1c0ddb2c820
SSDeep 49152:rvkt62XlaSFNWPjljiFa2RoUYIGbqobbR7LoGdrZTHHB72eh2NT:rv462XlaSFNWPjljiFXRoUYIGWoZ7
TLSH FAE54A0437F85E23E1ABE37395B0041367F0FC1AB363EB0B6591677A5C53B509982AA7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
53325c85f989794efad017732bb2fca4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client
Full Name
Client
EntryPoint
System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::ྈꗷ胁Čգ꺻乘艎렺䩌啍㦸�왠핳㍑陹ᆳ麣䁅(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::膺캔쎵ᕓ᫭꽫⧮嫹P൉뜗娕䓭愪ꂄ篬짝鱸턍(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 坩僓臗螈怉嬳⽑먖�鐱鲴ょ礳ὴ肛䓫䑴䝼::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::ྈꗷ胁Čգ꺻乘艎렺䩌啍㦸�왠핳㍑陹ᆳ麣䁅(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꃏ㝯黠荖ꦽ㎺ѡ朑▴歌�懥颚⣻忝炬�◛::膺캔쎵ᕓ᫭꽫⧮嫹P൉뜗娕䓭愪ꂄ篬짝鱸턍(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 坩僓臗螈怉嬳⽑먖�鐱鲴ょ礳ὴ肛䓫䑴䝼::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
53325c85f989794efad017732bb2fca4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙