Deep Malware Analysis of 6e0cabf11d8d9ee0fce6f3f334d4530c | md5: 6e0cabf11d8d9ee0fce6f3f334d4530c | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.38

PE Executable

MD5: 6e0cabf11d8d9ee0fce6f3f334d4530c

Size: 793.6 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	6e0cabf11d8d9ee0fce6f3f334d4530c
Sha1	1036439c22a39d57e6f5dc5e3a632101e16dea13
Sha256	4eeab2cf2fbf462f074426e1c927ac86bcfc3360ae8cea089a8a7ec6156200bc
Sha384	ac871b1838b6f27e9c527895f236f0a0ab440d7a45e891e4549956e6bde7730a3319e2862f9c71e0006a40e1fa43940b
Sha512	a2831d5594e4c305a8ff0c285446aa23b84fdf047ef2dd2a09412ce1feb1bc84c7464945c806d79bb0594af618e4fade1d66dbeb153100b923476bd2270a8c07
SSDeep	12288:WheB2msExD4G9gLtYH3SM/tzmzPC4imLD3JziDwQ/Wtrpehhqq3HU9C:WUB2QGGgtYCotzD0HY/SrOhqq3HUc
TLSH	16F401546B2ECF02C4B91BF20DB0E2B12764AD1EB451E2175FEA7CEBB429F111918763

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: mnILtu.pdb
Module Name	mnILtu.exe
Full Name	mnILtu.exe
EntryPoint	System.Void BitTools.Program::Main()
Scope Name	mnILtu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	mnILtu
Assembly Version	3.2.2.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	456
Main Method	System.Void BitTools.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void BitTools.Forms.MainLauncher::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`
Module Name	mnILtu.exe
Full Name	mnILtu.exe
EntryPoint	System.Void BitTools.Program::Main()
Scope Name	mnILtu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	mnILtu
Assembly Version	3.2.2.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	456
Main Method	System.Void BitTools.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void BitTools.Forms.MainLauncher::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.