Malicious
PE Executable
MD5: 68e32c669a3a49782dc0152dba8bb3a2
Size: 274.43 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score
Low
| MD5 | 68e32c669a3a49782dc0152dba8bb3a2 |
| Sha1 | 35dea6ffdbf7698b339dddb93369b18303686b00 |
| Sha256 | 3f3638fbc3bc326a996c034b2def5c1067c31a9c4ced9518abd73a485660fcb7 |
| Sha384 | 6d5481713844f6d75a49b7aafd9119809351fb6980f0d9a0fefe8abe907df09d625bd921b4a216d0d9e8075ebebb628c |
| Sha512 | ad1c7699e3b245f00e37a0ec2accde43bd1d089bef439c582a9d9f411125d1bf72f492b7264bbf51abe8d34e308a67fc592bd7f736b3800e83c9891fcfacc354 |
| SSDeep | 3072:qQ+blXHC7k7WZuXRAnxXFrXIV+gEN4PSL66U10dKQnVb2QfDs0LZY/Vgai/bbY:pQWrZ4P3y1nVb2udb |
| TLSH | F844741E2BE8A810E2FF8973D2B69125C5FBB4A346158D3E17D1E81A3A3E540DE05F53 |
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
malicious
3 nodes
Path
pe:exe>bin
Shape
pe:exe>bin
malicious
2 nodes
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Remington.exe |
| Full Name | Remington.exe |
| EntryPoint | System.Void Remington.COVID19::Main() |
| Scope Name | Remington.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Remington |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 4596 |
| Main Method | System.Void Remington.COVID19::Main() |
| Main IL Instruction Count | 640 |
| Main IL | |
| Module Name | Remington.exe |
| Full Name | Remington.exe |
| EntryPoint | System.Void Remington.COVID19::Main() |
| Scope Name | Remington.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Remington |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 4596 |
| Main Method | System.Void Remington.COVID19::Main() |
| Main IL Instruction Count | 640 |
| Main IL | |