Suspicious
Suspect

5d111baa0e77c02c77cb240dfb546497

PE Executable
MD5: 5d111baa0e77c02c77cb240dfb546497
Size: 805.38 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5d111baa0e77c02c77cb240dfb546497
Sha1 68cb0382fd73f351f752c785fad2990b96bb437f
Sha256 bf405d5470cb9900f08371031043f5c7c7a790fbc2af3b7d1fe43f9dbca1b705
Sha384 28f6ca85148fb21555d618ac6b318da59330ea438fe1d1d532f73d78c8896fc8a400283156e6446fb4f5b5860891ce41
Sha512 b5a61ba275e0db80bf9420bad52ed145ece454e9c6ad25feb6012d7bd4af316e6d278da077226686df9b718d05363479ec8da4a4c3c3a7eeadafa2eb7bb4957f
SSDeep 12288:Ek/r8H4IqVqkKDuHMpP2aHs/KuSaZYesNg+1YOMuNzunGyd:fr8HT4qnaH0P2l/daes9S7uNu
TLSH 2305BF2923CA674CF47EA3B8CBB1552887F0F816D6B1D30FBA6960FD6516F818548723
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5d111baa0e77c02c77cb240dfb546497
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Rie53y.g.resources
Rie53y.Resources.resources
8b302d76fee389.Resources.resources
3b51c5bc0
[NBF]root.Data
3b51c5bc1
[NBF]root.Data
3b51c5bc2
[NBF]root.Data
3b51c5bc3
[NBF]root.Data
3b51c5bc4
[NBF]root.Data
3b51c5bc5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rie53y
Full Name
Rie53y
EntryPoint
System.Void Rie53y.Mt5fc2E/yN_7xi0EtZi1zs.xi5NmPg2J::yJr1So9qc5Pn_()
Scope Name
Rie53y
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rie53y
Assembly Version
23.5.4.140
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1038
Main Method
System.Void Rie53y.Mt5fc2E/yN_7xi0EtZi1zs.xi5NmPg2J::yJr1So9qc5Pn_()
Main IL Instruction Count
97
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.0 <null>
ldc.i4.0 <null>
stloc.s V_5
ldloc.0 <null>
ldloc.s V_5
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_5
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.0 <null>
ldloc.s V_5
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_5
ldloc.s V_5
ldc.i4 5000
ble.s IL_001C: ldloc.0
ldstr FacilityBook Pro
stloc.1 <null>
ldc.i4 214
stloc.2 <null>
ldloc.2 <null>
call System.Object Rie53y.F_b49Mmyj2Kd::3SwiLsr08y(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.3 <null>
ldloc.3 <null>
castclass System.Byte[]
call System.Void Rie53y.3xqSpJi5b0Yd4/6AqettP3.Gnc3o::aDb7e1A(System.Byte[])
nop <null>
ldloc.1 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_0093: nop
ldloc.1 <null>
ldstr Application
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_4
ldloc.s V_4
ldloc.1 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_4
ldstr Service started: initializing compliance module.
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0101: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldstr FacilityBook Pro
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_8
ldstr Compliance module error (non-critical).
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_00F9: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F9: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0101: nop
nop <null>
ret <null>
Module Name
Rie53y
Full Name
Rie53y
EntryPoint
System.Void Rie53y.Mt5fc2E/yN_7xi0EtZi1zs.xi5NmPg2J::yJr1So9qc5Pn_()
Scope Name
Rie53y
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rie53y
Assembly Version
23.5.4.140
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1038
Main Method
System.Void Rie53y.Mt5fc2E/yN_7xi0EtZi1zs.xi5NmPg2J::yJr1So9qc5Pn_()
Main IL Instruction Count
97
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.0 <null>
ldc.i4.0 <null>
stloc.s V_5
ldloc.0 <null>
ldloc.s V_5
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_5
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.0 <null>
ldloc.s V_5
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_5
ldloc.s V_5
ldc.i4 5000
ble.s IL_001C: ldloc.0
ldstr FacilityBook Pro
stloc.1 <null>
ldc.i4 214
stloc.2 <null>
ldloc.2 <null>
call System.Object Rie53y.F_b49Mmyj2Kd::3SwiLsr08y(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.3 <null>
ldloc.3 <null>
castclass System.Byte[]
call System.Void Rie53y.3xqSpJi5b0Yd4/6AqettP3.Gnc3o::aDb7e1A(System.Byte[])
nop <null>
ldloc.1 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_0093: nop
ldloc.1 <null>
ldstr Application
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_4
ldloc.s V_4
ldloc.1 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_4
ldstr Service started: initializing compliance module.
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0101: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldstr FacilityBook Pro
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_8
ldstr Compliance module error (non-critical).
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_00F9: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F9: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0101: nop
nop <null>
ret <null>
5d111baa0e77c02c77cb240dfb546497
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Rie53y.g.resources
Rie53y.Resources.resources
8b302d76fee389.Resources.resources
3b51c5bc0
[NBF]root.Data
3b51c5bc1
[NBF]root.Data
3b51c5bc2
[NBF]root.Data
3b51c5bc3
[NBF]root.Data
3b51c5bc4
[NBF]root.Data
3b51c5bc5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙