55585f972fc090cdefeb3718fccf1e23

PE Executable

MD5: 55585f972fc090cdefeb3718fccf1e23

Size: 3.29 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	55585f972fc090cdefeb3718fccf1e23
Sha1	3c1afa847903a1f7091dc554043ed131581d037f
Sha256	f241de59a12e2e5bbb0af9335763fc2a66be9521b2c7aef7175b67c30f5ed64c
Sha384	a9837d078e1b3e3d2f553c79b9b2257f84ea4e6c316b7b1c99c3f642f40bfa3f27871dd880b0ce67bd8690ba832ecfbb
Sha512	7c72cea7c97dd8fa71722105a42c346619dbf3eeaeba0dd0268fcbf66af7854983f476fee735b17cd7741672124ef6c1346e0d94696b929afc24889bcacc723b
SSDeep	49152:QvEt62XlaSFNWPjljiFa2RoUYIUm+iGCmzw3oGdLTHHB72eh2NT:QvY62XlaSFNWPjljiFXRoUYIX+iGY
TLSH	CDE55A0477F85E62E56BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info	Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_d10282be.exe
Module Name	Client
Full Name	Client
EntryPoint	System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	11123
Main Method	System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::蘃ꦦ练焏ᛄㄫ敱鬌㼃돷⚘骦⧇㪛衭蔗퍵捁潂(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::╈䔺甤谔�췘뮲쿡白㧗䖺薂懨ᘆ飫ﮋЗ峲(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 餩┑䰱滳ⓙ䎢㵈腹䈮�㈫䈓㢗ᆕ�胩⻃::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	11123
Main Method	System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::蘃ꦦ练焏ᛄㄫ敱鬌㼃돷⚘骦⧇㪛衭蔗퍵捁潂(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 务㤩�蠴尩櫓￉ྟ芼ꂷۗд鉪絎�췣遧灃::╈䔺甤谔�췘뮲쿡白㧗䖺薂懨ᘆ飫ﮋЗ峲(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 餩┑䰱滳ⓙ䎢㵈腹䈮�㈫䈓㢗ᆕ�胩⻃::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

55585f972fc090cdefeb3718fccf1e23

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

55585f972fc090cdefeb3718fccf1e23 › [Rebuild from dump]_d10282be.exe

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.