Deep Malware Analysis of 6002e683bd3e42668a40cb0b0ab6e46b | md5: 6002e683bd3e42668a40cb0b0ab6e46b | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.13

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	6002e683bd3e42668a40cb0b0ab6e46b
Sha1	1d6662eefa5744a3ae13c5ac437cde9fa0673d95
Sha256	0f546fee6a66dd05082402fcf23e426d2b5bd8a97f6544b77ad951e1f65689bd
Sha384	aa3a733362595ef6b532ec7ee1c901975472e6cf7e8961dfbf7bdfafe3a16140c6c235cfe239cb93f605b6648ef0c577
Sha512	25d964000707611f32e9767d9b0a5bffcd2a04671295d647a83b54b45b202c9debf18a13f2fd6e578fadd81f799565dc62fd8be1ea59c4f0430a1ed8f3a34387
SSDeep	196608:AE6udtosUCvjD4uBVhMoaKDLCDCsfUsEeXn97O:AqXKmj3BVHacCDfflLX9y
TLSH	A266339C731079CEC8E396B19A64DDB4E3712CEA1327C21790D369ABFE0C1D29E551E2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Name	Value
Module Name	fCIa.exe
Full Name	fCIa.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	fCIa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fCIa
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁭⁮⁬‮⁪‌‫‍‮‪‮‮⁬‍‪‪⁫‌‮‪‎‮‮‮‏‪⁭⁬‪‍‬‎⁭‮⁮‎‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::‌‌‍‌‮‭⁫‭‫⁮⁬⁫⁬‭‏‫⁫⁯‎⁪⁪‭‪‭‪⁫‬⁯‬‭‭‬⁮⁬‭⁬‎‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‬‬‌‪⁪‪‏⁭‎‫‬⁫‌‪⁯‍‭‮‬‏⁬‫‪‬‮⁮‏‫‍⁯‪‪‎‌‍⁮‍‮(System.Windows.Forms.Form) ret <null>
Module Name	fCIa.exe
Full Name	fCIa.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	fCIa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	fCIa
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁭⁮⁬‮⁪‌‫‍‮‪‮‮⁬‍‪‪⁫‌‮‪‎‮‮‮‏‪⁭⁬‪‍‬‎⁭‮⁮‎‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::‌‌‍‌‮‭⁫‭‫⁮⁬⁫⁬‭‏‫⁫⁯‎⁪⁪‭‪‭‪⁫‬⁯‬‭‭‬⁮⁬‭⁬‎‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‬‬‌‪⁪‪‏⁭‎‫‬⁫‌‪⁯‍‭‮‬‏⁬‫‪‬‮⁮‏‫‍⁯‪‪‎‌‍⁮‍‮(System.Windows.Forms.Form) ret <null>

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential