Deep Malware Analysis of 6828d778a57df3285cde194e271c5e5a | md5: 6828d778a57df3285cde194e271c5e5a | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.84

PE Executable

MD5: 6828d778a57df3285cde194e271c5e5a

Size: 5.97 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	6828d778a57df3285cde194e271c5e5a
Sha1	6d7c3c4be6fc4d4c47341edb9e097d9745a829e6
Sha256	9ac1c1dba1be97cd28dd88c4c8b33a7cb08d7601157278e49433eb9b1c283cf0
Sha384	fef4497c6f8c711f17d711edc6cdb1439c16b167a34aaad30e7d225b9abfb912c0cbf13cb2c33c8cbf87a174772cd76b
Sha512	c93712fc7342fabeb3dd4f3e5f35bf688ff3423baa1bb11885b8df85b1eb84f291873d3e13f124de3e1cd2cf626f854323b84a15deffe602069d24e7817542d7
SSDeep	98304:AXoFsj50Ix7rP7MRvvk0rCvzRfEXW9C34K6UACDX:01/rPIt80rRW9Z4A
TLSH	6556122127941828E1798B74583A5583C7F2FD0D5B71CB2E368AD16D4A32B46EF92F33

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	5axYeC3eL4
Full Name	5axYeC3eL4
EntryPoint	System.Void 5axYeC3eL4.6XorbmM51Fdbn/dNc4q2Gj.5Fcyz::6Xtkm4Dn2eg()
Scope Name	5axYeC3eL4
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	5axYeC3eL4
Assembly Version	17.28.43.78
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	2059
Main Method	System.Void 5axYeC3eL4.6XorbmM51Fdbn/dNc4q2Gj.5Fcyz::6Xtkm4Dn2eg()
Main IL Instruction Count	99
Main IL	nop <null> call System.Boolean System.Diagnostics.Debugger::get_IsAttached() stloc.0 <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldc.r8 0 stloc.1 <null> ldc.i4.0 <null> stloc.s V_6 ldloc.1 <null> ldloc.s V_6 conv.r8 <null> ldc.r8 0.01 mul <null> call System.Double System.Math::Sin(System.Double) ldloc.s V_6 conv.r8 <null> ldc.r8 0.015 mul <null> call System.Double System.Math::Cos(System.Double) mul <null> add <null> stloc.1 <null> ldloc.s V_6 ldc.i4.1 <null> add.ovf <null> stloc.s V_6 ldloc.s V_6 ldc.i4 5000 ble.s IL_0022: ldloc.1 ldstr FacilityBook Pro stloc.2 <null> ldc.i4 214 stloc.3 <null> ldloc.3 <null> call System.Object 5axYeC3eL4.6XorbmM51Fdbn::9Ygsja7W3Jzz(System.Int32) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_4 ldloc.s V_4 castclass System.Byte[] call System.Void 5axYeC3eL4.6XorbmM51Fdbn::ii2Rk6Qnqr5T0A(System.Byte[]) nop <null> ldloc.2 <null> call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_009B: nop ldloc.2 <null> ldstr Application call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String) nop <null> nop <null> nop <null> ldstr Application newobj System.Void System.Diagnostics.EventLog::.ctor(System.String) stloc.s V_5 ldloc.s V_5 ldloc.2 <null> callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String) nop <null> ldloc.s V_5 ldstr Service started: initializing compliance module. ldc.i4.4 <null> callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType) nop <null> leave.s IL_0109: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 nop <null> nop <null> ldstr Application newobj System.Void System.Diagnostics.EventLog::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldstr FacilityBook Pro callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String) nop <null> ldloc.s V_9 ldstr Compliance module error (non-critical). ldc.i4.2 <null> callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType) nop <null> leave.s IL_0101: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0101: nop nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0109: nop nop <null> ret <null>
Module Name	5axYeC3eL4
Full Name	5axYeC3eL4
EntryPoint	System.Void 5axYeC3eL4.6XorbmM51Fdbn/dNc4q2Gj.5Fcyz::6Xtkm4Dn2eg()
Scope Name	5axYeC3eL4
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	5axYeC3eL4
Assembly Version	17.28.43.78
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	2059
Main Method	System.Void 5axYeC3eL4.6XorbmM51Fdbn/dNc4q2Gj.5Fcyz::6Xtkm4Dn2eg()
Main IL Instruction Count	99
Main IL	nop <null> call System.Boolean System.Diagnostics.Debugger::get_IsAttached() stloc.0 <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldc.r8 0 stloc.1 <null> ldc.i4.0 <null> stloc.s V_6 ldloc.1 <null> ldloc.s V_6 conv.r8 <null> ldc.r8 0.01 mul <null> call System.Double System.Math::Sin(System.Double) ldloc.s V_6 conv.r8 <null> ldc.r8 0.015 mul <null> call System.Double System.Math::Cos(System.Double) mul <null> add <null> stloc.1 <null> ldloc.s V_6 ldc.i4.1 <null> add.ovf <null> stloc.s V_6 ldloc.s V_6 ldc.i4 5000 ble.s IL_0022: ldloc.1 ldstr FacilityBook Pro stloc.2 <null> ldc.i4 214 stloc.3 <null> ldloc.3 <null> call System.Object 5axYeC3eL4.6XorbmM51Fdbn::9Ygsja7W3Jzz(System.Int32) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_4 ldloc.s V_4 castclass System.Byte[] call System.Void 5axYeC3eL4.6XorbmM51Fdbn::ii2Rk6Qnqr5T0A(System.Byte[]) nop <null> ldloc.2 <null> call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_009B: nop ldloc.2 <null> ldstr Application call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String) nop <null> nop <null> nop <null> ldstr Application newobj System.Void System.Diagnostics.EventLog::.ctor(System.String) stloc.s V_5 ldloc.s V_5 ldloc.2 <null> callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String) nop <null> ldloc.s V_5 ldstr Service started: initializing compliance module. ldc.i4.4 <null> callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType) nop <null> leave.s IL_0109: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 nop <null> nop <null> ldstr Application newobj System.Void System.Diagnostics.EventLog::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldstr FacilityBook Pro callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String) nop <null> ldloc.s V_9 ldstr Compliance module error (non-critical). ldc.i4.2 <null> callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType) nop <null> leave.s IL_0101: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0101: nop nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0109: nop nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.