Deep Malware Analysis of 58b4cfcb3ba3b8db7c671239a6a2ea91 | md5: 58b4cfcb3ba3b8db7c671239a6a2ea91 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.88 | Fody/Costura Packer | SOS: 0.00 | RAT | AgentTesla | SOS: 0.49

PE Executable

MD5: 58b4cfcb3ba3b8db7c671239a6a2ea91

Size: 1.99 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	58b4cfcb3ba3b8db7c671239a6a2ea91
Sha1	c3bb73f1e401665150bc520c225f2602a461ccc3
Sha256	5d53d190c150a8f0efb04cdfd9f607d0cd30452eb1c9e5b59a97d137dd47ecb5
Sha384	0cb2266fa41ca6c022467bb2b1e0f5b1cbe140968fd1c3a67612690852ef84ed0c4c390875536c35380b053e3201443e
Sha512	0811d83715ed8a9fe39a8817618deacf5907d5c866658c8afffcf7a3f35fdac61a6a1b72f100213a934463824e3558a3c3b519840ce5f560543b163f5332fe94
SSDeep	49152:7JOsa7anKy1S9/aOHRnAovgncO3JVO71O7t:7JOsa7im/aORgnRJK4
TLSH	3C95E04BB7490870D468A63EC5EA4109E3F5B5456323F78F7989136A0E133E9ED2E783

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: Syntex Spoofer.pdb
Module Name	Syntex Spoofer.exe
Full Name	Syntex Spoofer.exe
EntryPoint	System.Void k1jnaxaQsdET8qOY4R.O1rKDT8B7Dray0sn5D::qCmtu0vwa()
Scope Name	Syntex Spoofer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Syntex Spoofer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void k1jnaxaQsdET8qOY4R.O1rKDT8B7Dray0sn5D::qCmtu0vwa()
Main IL Instruction Count	32
Main IL	ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0078: newobj System.Void Syntex_Spoofer.Menu::.ctor() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ret <null> call System.Void W5RdeaY61ty1Yrpx5VK.Fun7sVYtGXtEWKb2pYh::heBHVi9fah() ldc.i4 0 ldsfld <Module>{e1311ce7-5c03-424c-855c-56b974e71d25} <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_b0fdef23364b43c796d3f174d94eb1ba ldfld System.Int32 <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_1265d693e7e941fab5dd1029b0390909 brfalse IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) pop <null> ldc.i4 0 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 0 ldsfld <Module>{e1311ce7-5c03-424c-855c-56b974e71d25} <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_b0fdef23364b43c796d3f174d94eb1ba ldfld System.Int32 <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_6ef23cd5368843918bfcf22f927c81f9 brtrue IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) pop <null> ldc.i4 1 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054)
Module Name	Syntex Spoofer.exe
Full Name	Syntex Spoofer.exe
EntryPoint	System.Void k1jnaxaQsdET8qOY4R.O1rKDT8B7Dray0sn5D::qCmtu0vwa()
Scope Name	Syntex Spoofer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Syntex Spoofer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	44
Main Method	System.Void k1jnaxaQsdET8qOY4R.O1rKDT8B7Dray0sn5D::qCmtu0vwa()
Main IL Instruction Count	32
Main IL	ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0078: newobj System.Void Syntex_Spoofer.Menu::.ctor() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 4 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ret <null> call System.Void W5RdeaY61ty1Yrpx5VK.Fun7sVYtGXtEWKb2pYh::heBHVi9fah() ldc.i4 0 ldsfld <Module>{e1311ce7-5c03-424c-855c-56b974e71d25} <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_b0fdef23364b43c796d3f174d94eb1ba ldfld System.Int32 <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_1265d693e7e941fab5dd1029b0390909 brfalse IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) pop <null> ldc.i4 0 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 0 ldsfld <Module>{e1311ce7-5c03-424c-855c-56b974e71d25} <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_b0fdef23364b43c796d3f174d94eb1ba ldfld System.Int32 <Module>{e1311ce7-5c03-424c-855c-56b974e71d25}::m_6ef23cd5368843918bfcf22f927c81f9 brtrue IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054) pop <null> ldc.i4 1 br IL_0012: switch(IL_0078,IL_0053,IL_0030,IL_0040,IL_0054)

No malware configuration was found at this point.

You must be signed in to view YARA rules.