Suspicious
Suspect

PE Executable
MD5: 65477fcce7768974b86c665fbb010c64
Size: 1.29 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 65477fcce7768974b86c665fbb010c64
Sha1 f1ad7d076e31f67960a8dd7649c196b95ed1d659
Sha256 26a229f9c3d82111d8a235e29cf7f594fc0f7e22b892d73a429afefa090c23ce
Sha384 6303444a1928cbc2b0fe7ca085a474fbbca95cdb782096f185f3ff437707224192d3db993cc239d5425c9065b6dde3f9
Sha512 4428e248c4bc3dd95f147178d7397a67cbe37083d7d44afe086452693414a13ac59f1c09b4fcf8b454d3e9dc299468c2cc4795d592c999a0d451ac0bc1b20bb3
SSDeep 24576:jfmN3t/U1aLOEasdBMvfmIazWgOmkwuhv7NU6MFip87eYfSdsO4BjeX6g:Slt/UkLO5sdBMX8agOh7+7Fip7YfSds4
TLSH 6D5512883790F05FD863D6719DB0ED74AA657CABA312C20795D32C9B7D0DA968E103E3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
65477fcce7768974b86c665fbb010c64
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Star_generator.Form1.resources
$this.Icon
[NBF]root.IconData
Moon
[NBF]root.Data
Star_generator.Properties.Resources.resources
DwFO
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x136800 size 13832 bytes
Module Name
cXfr.exe
Full Name
cXfr.exe
EntryPoint
System.Void Canada_Simulator.Program::Main()
Scope Name
cXfr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
cXfr
Assembly Version
3.9.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
254
Main Method
System.Void Canada_Simulator.Program::Main()
Main IL Instruction Count
31
Main IL 
call System.Void Canada_Simulator.Program::‎​‭​‎‌‮‌‭‬‍‏‪‎‎‭‏‭‏‮()
ldc.i4.0 <null>
call System.Void Canada_Simulator.Program::‮‎‭‌‍‌‌‪‎‎‫‎‍‌‍‮‭‫‪‎‪‏‭‮‭‮‮(System.Boolean)
ldc.i4 1641057336
ldc.i4 1949746017
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_006D: ret
newobj System.Void Star_generator.Form1::.ctor()
call System.Void Canada_Simulator.Program::‌‎‌‫‏‏‍‌​‭‎‍‎‬‪‪‪‪‌‬‭‍‪‮‭‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 657925045
mul <null>
ldc.i4 -1720238840
xor <null>
br.s IL_0010: ldc.i4 1949746017
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::Menu()
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::FailSafe()
ldloc.0 <null>
ldc.i4 1171299962
mul <null>
ldc.i4 311899231
xor <null>
br.s IL_0010: ldc.i4 1949746017
ret <null>
Module Name
cXfr.exe
Full Name
cXfr.exe
EntryPoint
System.Void Canada_Simulator.Program::Main()
Scope Name
cXfr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
cXfr
Assembly Version
3.9.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
254
Main Method
System.Void Canada_Simulator.Program::Main()
Main IL Instruction Count
31
Main IL 
call System.Void Canada_Simulator.Program::‎​‭​‎‌‮‌‭‬‍‏‪‎‎‭‏‭‏‮()
ldc.i4.0 <null>
call System.Void Canada_Simulator.Program::‮‎‭‌‍‌‌‪‎‎‫‎‍‌‍‮‭‫‪‎‪‏‭‮‭‮‮(System.Boolean)
ldc.i4 1641057336
ldc.i4 1949746017
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_006D: ret
newobj System.Void Star_generator.Form1::.ctor()
call System.Void Canada_Simulator.Program::‌‎‌‫‏‏‍‌​‭‎‍‎‬‪‪‪‪‌‬‭‍‪‮‭‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 657925045
mul <null>
ldc.i4 -1720238840
xor <null>
br.s IL_0010: ldc.i4 1949746017
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::Menu()
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::FailSafe()
ldloc.0 <null>
ldc.i4 1171299962
mul <null>
ldc.i4 311899231
xor <null>
br.s IL_0010: ldc.i4 1949746017
ret <null>
65477fcce7768974b86c665fbb010c64
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Star_generator.Form1.resources
$this.Icon
[NBF]root.IconData
Moon
[NBF]root.Data
Star_generator.Properties.Resources.resources
DwFO
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙