Suspicious
Suspect

5942bd8fd4abd4845ff446bd29a49e9b

PE Executable
MD5: 5942bd8fd4abd4845ff446bd29a49e9b
Size: 616.45 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5942bd8fd4abd4845ff446bd29a49e9b
Sha1 521d318dba9593e756d8f0c26fce2b9687cc641e
Sha256 ddc72caa3151b8ed4d54dae76f078dbe0c3d3de110ec9bee16c29c7f76b2720b
Sha384 38793db86e5a5a3fb50ab28eb245bb1b45dfcbdc91f5c8612041db1eae3e9fc05ec3ba397fea10edf658feddf38c38ea
Sha512 5a29c10232987e9b38dac7ce1a3ae9f8f21d04256c82b1b8986141008ab23d767def086a6503f269645587a5527638727eaba48d2a8c61abd39dd408a4bc7dba
SSDeep 12288:kuWMcLPIDZtNItbVY09AzuzxD35dOkfH:CMlDmY56pf
TLSH 0DD49D1627EC6B54F1FE9B39A47010004BF5F853EB32DA5E7E6558EE0861F808E62727
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5942bd8fd4abd4845ff446bd29a49e9b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Fedaliruant.Resturnigi.png
dd8D7.Resources.resources
00a89604b2f5dd.Resources.resources
5dbed0eb0
[NBF]root.Data
5dbed0eb1
[NBF]root.Data
5dbed0eb2
[NBF]root.Data
5dbed0eb3
[NBF]root.Data
5dbed0eb4
[NBF]root.Data
5dbed0eb5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
dd8D7
Full Name
dd8D7
EntryPoint
System.Void dd8D7.9kbFNq7::q_9Jj6Ea0zpXR()
Scope Name
dd8D7
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dd8D7
Assembly Version
7.5.27.134
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1479
Main Method
System.Void dd8D7.9kbFNq7::q_9Jj6Ea0zpXR()
Main IL Instruction Count
116
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Resturnigi.png
stloc.1 <null>
ldloc.1 <null>
ldloca.s V_2
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_004A: ldloc.3
leave IL_0115: ret
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ldstr GetManifestResourceNames
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.String[]
stloc.s V_5
newobj System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::.ctor()
stloc.s V_7
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_6
br.s IL_009E: ldloc.s V_6
ldloc.s V_7
ldloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::Add(System.Int32,System.String)
nop <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_9
ble.s IL_0089: ldloc.s V_7
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String> System.Collections.Generic.Dictionary`2<System.Int32,System.String>::GetEnumerator()
stloc.s V_10
br.s IL_00DD: ldloca.s V_10
ldloca.s V_10
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.String> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::get_Current()
stloc.s V_11
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
ldloc.1 <null>
callvirt System.Boolean System.String::EndsWith(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00DB: nop
ldloc.3 <null>
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
nop <null>
nop <null>
nop <null>
ldloca.s V_10
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::MoveNext()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B0: ldloca.s V_10
leave.s IL_00FB: ldloc.3
ldloca.s V_10
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.3 <null>
call System.Void dd8D7.0rqJzZ9tz/4DmqpfM5_.4baBabX7Lf2k::7tjQwwJ4Wg3(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0114: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_14
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0114: nop
nop <null>
ret <null>
Module Name
dd8D7
Full Name
dd8D7
EntryPoint
System.Void dd8D7.9kbFNq7::q_9Jj6Ea0zpXR()
Scope Name
dd8D7
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dd8D7
Assembly Version
7.5.27.134
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1479
Main Method
System.Void dd8D7.9kbFNq7::q_9Jj6Ea0zpXR()
Main IL Instruction Count
116
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Resturnigi.png
stloc.1 <null>
ldloc.1 <null>
ldloca.s V_2
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_004A: ldloc.3
leave IL_0115: ret
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ldstr GetManifestResourceNames
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.String[]
stloc.s V_5
newobj System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::.ctor()
stloc.s V_7
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_6
br.s IL_009E: ldloc.s V_6
ldloc.s V_7
ldloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::Add(System.Int32,System.String)
nop <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_9
ble.s IL_0089: ldloc.s V_7
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String> System.Collections.Generic.Dictionary`2<System.Int32,System.String>::GetEnumerator()
stloc.s V_10
br.s IL_00DD: ldloca.s V_10
ldloca.s V_10
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.String> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::get_Current()
stloc.s V_11
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
ldloc.1 <null>
callvirt System.Boolean System.String::EndsWith(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00DB: nop
ldloc.3 <null>
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
nop <null>
nop <null>
nop <null>
ldloca.s V_10
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::MoveNext()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B0: ldloca.s V_10
leave.s IL_00FB: ldloc.3
ldloca.s V_10
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.3 <null>
call System.Void dd8D7.0rqJzZ9tz/4DmqpfM5_.4baBabX7Lf2k::7tjQwwJ4Wg3(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0114: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_14
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0114: nop
nop <null>
ret <null>
5942bd8fd4abd4845ff446bd29a49e9b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Fedaliruant.Resturnigi.png
dd8D7.Resources.resources
00a89604b2f5dd.Resources.resources
5dbed0eb0
[NBF]root.Data
5dbed0eb1
[NBF]root.Data
5dbed0eb2
[NBF]root.Data
5dbed0eb3
[NBF]root.Data
5dbed0eb4
[NBF]root.Data
5dbed0eb5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙