Deep Malware Analysis of 6002e683bd3e42668a40cb0b0ab6e46b | md5: 6002e683bd3e42668a40cb0b0ab6e46b | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.13

PE Executable

MD5: 6002e683bd3e42668a40cb0b0ab6e46b

Size: 7.02 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	6002e683bd3e42668a40cb0b0ab6e46b
Sha1	1d6662eefa5744a3ae13c5ac437cde9fa0673d95
Sha256	0f546fee6a66dd05082402fcf23e426d2b5bd8a97f6544b77ad951e1f65689bd
Sha384	aa3a733362595ef6b532ec7ee1c901975472e6cf7e8961dfbf7bdfafe3a16140c6c235cfe239cb93f605b6648ef0c577
Sha512	25d964000707611f32e9767d9b0a5bffcd2a04671295d647a83b54b45b202c9debf18a13f2fd6e578fadd81f799565dc62fd8be1ea59c4f0430a1ed8f3a34387
SSDeep	196608:AE6udtosUCvjD4uBVhMoaKDLCDCsfUsEeXn97O:AqXKmj3BVHacCDfflLX9y
TLSH	A266339C731079CEC8E396B19A64DDB4E3712CEA1327C21790D369ABFE0C1D29E551E2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Name	Value
Module Name	fCIa.exe
Full Name	fCIa.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	fCIa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fCIa
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁭⁮⁬‮⁪‌‫‍‮‪‮‮⁬‍‪‪⁫‌‮‪‎‮‮‮‏‪⁭⁬‪‍‬‎⁭‮⁮‎‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::‌‌‍‌‮‭⁫‭‫⁮⁬⁫⁬‭‏‫⁫⁯‎⁪⁪‭‪‭‪⁫‬⁯‬‭‭‬⁮⁬‭⁬‎‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‬‬‌‪⁪‪‏⁭‎‫‬⁫‌‪⁯‍‭‮‬‏⁬‫‪‬‮⁮‏‫‍⁯‪‪‎‌‍⁮‍‮(System.Windows.Forms.Form) ret <null>
Module Name	fCIa.exe
Full Name	fCIa.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	fCIa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fCIa
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁭⁮⁬‮⁪‌‫‍‮‪‮‮⁬‍‪‪⁫‌‮‪‎‮‮‮‏‪⁭⁬‪‍‬‎⁭‮⁮‎‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::‌‌‍‌‮‭⁫‭‫⁮⁬⁫⁬‭‏‫⁫⁯‎⁪⁪‭‪‭‪⁫‬⁯‬‭‭‬⁮⁬‭⁬‎‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‬‬‌‪⁪‪‏⁭‎‫‬⁫‌‪⁯‍‭‮‬‏⁬‫‪‬‮⁮‏‫‍⁯‪‪‎‌‍⁮‍‮(System.Windows.Forms.Form) ret <null>

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

6002e683bd3e42668a40cb0b0ab6e46b

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

6002e683bd3e42668a40cb0b0ab6e46b

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.