Suspicious
Suspect

PE Executable
MD5: 693ec61085d84cab92226bf6a2403408
Size: 988.67 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 693ec61085d84cab92226bf6a2403408
Sha1 f795147513628e8cf8e262d942017643641fa144
Sha256 84b6e7c39ea67509b28d31aa2544bab496562361af72e2ce5bb3e7158d90e746
Sha384 f98479498bef1f38c84701e836823adbfd585edcfafcc8765ffb2508882330207861fc3ec369d4ee5cae158c6cd4625f
Sha512 8a31bc37d0ad27be0b03b2efa4e1473fd42802160b2359abc2b97c1a29af1a7aa78ff9a5626b598ad11c490bd8dad8125a42e3ef0b663519fa3dc762f0ffa9c4
SSDeep 12288:gy/NRX3l0V7olLLdyR9drtX7GwQvOl/RLR31kPvphcIr2:J/3l0VmLLduzrJGw8Olj1kHUIa
TLSH 8725BE012BE94F98F4BF57388D35061447F7FC02CE3ADB9E1D9968AD2971B815A62323
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
693ec61085d84cab92226bf6a2403408
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Pobregas.67594
W_c0q8nR.Resources.resources
dfa6ccb626f631.Resources.resources
d06eadcc0
[NBF]root.Data
d06eadcc1
[NBF]root.Data
d06eadcc10
[NBF]root.Data
d06eadcc11
[NBF]root.Data
d06eadcc12
[NBF]root.Data
d06eadcc13
[NBF]root.Data
d06eadcc14
[NBF]root.Data
d06eadcc15
[NBF]root.Data
d06eadcc16
[NBF]root.Data
d06eadcc17
[NBF]root.Data
d06eadcc18
[NBF]root.Data
d06eadcc19
[NBF]root.Data
d06eadcc2
[NBF]root.Data
d06eadcc20
[NBF]root.Data
d06eadcc21
[NBF]root.Data
d06eadcc22
[NBF]root.Data
d06eadcc23
[NBF]root.Data
d06eadcc3
[NBF]root.Data
d06eadcc4
[NBF]root.Data
d06eadcc5
[NBF]root.Data
d06eadcc6
[NBF]root.Data
d06eadcc7
[NBF]root.Data
d06eadcc8
[NBF]root.Data
d06eadcc9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
W_c0q8nR
Full Name
W_c0q8nR
EntryPoint
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Scope Name
W_c0q8nR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
W_c0q8nR
Assembly Version
8.11.48.17
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void W_c0q8nR.0sbKe5Mkyn8WY/dQr53aHtaL2p.6Yjkz4PyApc0j8::3Rpia4(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
Module Name
W_c0q8nR
Full Name
W_c0q8nR
EntryPoint
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Scope Name
W_c0q8nR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
W_c0q8nR
Assembly Version
8.11.48.17
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void W_c0q8nR.0sbKe5Mkyn8WY/dQr53aHtaL2p.6Yjkz4PyApc0j8::3Rpia4(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
693ec61085d84cab92226bf6a2403408
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Pobregas.67594
W_c0q8nR.Resources.resources
dfa6ccb626f631.Resources.resources
d06eadcc0
[NBF]root.Data
d06eadcc1
[NBF]root.Data
d06eadcc10
[NBF]root.Data
d06eadcc11
[NBF]root.Data
d06eadcc12
[NBF]root.Data
d06eadcc13
[NBF]root.Data
d06eadcc14
[NBF]root.Data
d06eadcc15
[NBF]root.Data
d06eadcc16
[NBF]root.Data
d06eadcc17
[NBF]root.Data
d06eadcc18
[NBF]root.Data
d06eadcc19
[NBF]root.Data
d06eadcc2
[NBF]root.Data
d06eadcc20
[NBF]root.Data
d06eadcc21
[NBF]root.Data
d06eadcc22
[NBF]root.Data
d06eadcc23
[NBF]root.Data
d06eadcc3
[NBF]root.Data
d06eadcc4
[NBF]root.Data
d06eadcc5
[NBF]root.Data
d06eadcc6
[NBF]root.Data
d06eadcc7
[NBF]root.Data
d06eadcc8
[NBF]root.Data
d06eadcc9
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙