5a6f42b98991168c263f9a3181259320

PE Executable

MD5: 5a6f42b98991168c263f9a3181259320

Size: 168.96 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	5a6f42b98991168c263f9a3181259320
Sha1	71d9794c74a7eba6a47d271de8864cd5ddabb946
Sha256	05ea2c8c8023b899976a271b825c2ef5cb3861101d167bf37949e6ffb2ee9b71
Sha384	3bdf55025c9a67a91c0b809b4f70e9a8ed45f9bf513e79d421c48436d95e0aafb1c3f8e3e688e3556681963c9a49cd32
Sha512	d1f57a687899cec5852af1497ed729fd815cea3f113ee88cda0dd3f2314f692981ace8996369acc04384aa20aa3482d98263e6cad72500625874ecb560880105
SSDeep	3072:JXjdYg8aMvUdORGKE2gzXfv9bpJYWKvmjeDR+sSPuiO3HgOVJ88iDg8EUoOHmh:NjQvO9b/avvwsUO3HgK8E3
TLSH	25F3D6247AE55259F1B76FB2CBD570CE46BDE2732E03631A549103431E23A81FDE392A

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	PSiQ8lDeA4ESqZZx7yIX
Full Name	PSiQ8lDeA4ESqZZx7yIX
EntryPoint	System.Void rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::Ka8XVMgtQgZsbCRiKBxc()
Scope Name	PSiQ8lDeA4ESqZZx7yIX
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	newpayload
Assembly Version	7.23.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1223
Main Method	System.Void rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::Ka8XVMgtQgZsbCRiKBxc()
Main IL Instruction Count	17
Main IL	call System.Boolean rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::YYh0IjQ4PsamvDStUeCD() brfalse IL_0038: ret call System.Boolean rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::6HFxpmG7OLbDfo0gQ1X7() brfalse IL_0039: ret call System.Boolean rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::ftQfoRhLzyFxYeUQSjaW() brfalse IL_003A: ret call System.Boolean rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::diQDQ7GGdcctR4XdrZI8() brfalse IL_003B: ret call System.Boolean rMKSyuddWtYVpGbO3Wfo.Exs5QvX58ZDcORsZc0hr::Fu8PGefA4JX6qBtwcMYR() brfalse IL_003C: ret call System.Void 9DiaBmqM2VGn3B1KRRkd.wVhz8feEaoyVpbruDqpn::GTM3EejTbDd8h8LNWjCV() ret <null> ret <null> ret <null> ret <null> ret <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.