Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 693ec61085d84cab92226bf6a2403408
Size: 988.67 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 693ec61085d84cab92226bf6a2403408
Sha1 f795147513628e8cf8e262d942017643641fa144
Sha256 84b6e7c39ea67509b28d31aa2544bab496562361af72e2ce5bb3e7158d90e746
Sha384 f98479498bef1f38c84701e836823adbfd585edcfafcc8765ffb2508882330207861fc3ec369d4ee5cae158c6cd4625f
Sha512 8a31bc37d0ad27be0b03b2efa4e1473fd42802160b2359abc2b97c1a29af1a7aa78ff9a5626b598ad11c490bd8dad8125a42e3ef0b663519fa3dc762f0ffa9c4
SSDeep 12288:gy/NRX3l0V7olLLdyR9drtX7GwQvOl/RLR31kPvphcIr2:J/3l0VmLLduzrJGw8Olj1kHUIa
TLSH 8725BE012BE94F98F4BF57388D35061447F7FC02CE3ADB9E1D9968AD2971B815A62323
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
693ec61085d84cab92226bf6a2403408
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Pobregas.67594
W_c0q8nR.Resources.resources
dfa6ccb626f631.Resources.resources
d06eadcc0
[NBF]root.Data
d06eadcc1
[NBF]root.Data
d06eadcc10
[NBF]root.Data
d06eadcc11
[NBF]root.Data
d06eadcc12
[NBF]root.Data
d06eadcc13
[NBF]root.Data
d06eadcc14
[NBF]root.Data
d06eadcc15
[NBF]root.Data
d06eadcc16
[NBF]root.Data
d06eadcc17
[NBF]root.Data
d06eadcc18
[NBF]root.Data
d06eadcc19
[NBF]root.Data
d06eadcc2
[NBF]root.Data
d06eadcc20
[NBF]root.Data
d06eadcc21
[NBF]root.Data
d06eadcc22
[NBF]root.Data
d06eadcc23
[NBF]root.Data
d06eadcc3
[NBF]root.Data
d06eadcc4
[NBF]root.Data
d06eadcc5
[NBF]root.Data
d06eadcc6
[NBF]root.Data
d06eadcc7
[NBF]root.Data
d06eadcc8
[NBF]root.Data
d06eadcc9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
W_c0q8nR
Full Name
W_c0q8nR
EntryPoint
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Scope Name
W_c0q8nR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
W_c0q8nR
Assembly Version
8.11.48.17
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void W_c0q8nR.0sbKe5Mkyn8WY/dQr53aHtaL2p.6Yjkz4PyApc0j8::3Rpia4(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
Module Name
W_c0q8nR
Full Name
W_c0q8nR
EntryPoint
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Scope Name
W_c0q8nR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
W_c0q8nR
Assembly Version
8.11.48.17
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void W_c0q8nR.t_0FiQm29dm::ng6JrEw43aB()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void W_c0q8nR.0sbKe5Mkyn8WY/dQr53aHtaL2p.6Yjkz4PyApc0j8::3Rpia4(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙