71781d7b59d4c1b1015e86cd71b1b583

PE Executable

MD5: 71781d7b59d4c1b1015e86cd71b1b583

Size: 1.65 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	71781d7b59d4c1b1015e86cd71b1b583
Sha1	792c6a1c25732a6c03ed1d0375643b8a54cfbbf0
Sha256	b242bab0944ea9371a40d6e803dc2685ad71d87f03341b3d57fd3e05c479a5c5
Sha384	ae7ff6bb823560185da73607a79c89ef9dc1097fefa2b50d5d63d1de27237152a4ece39d89f5130b9f763fdc99fbb00e
Sha512	66e96781c81b7f6025a513049589033dbeb6e90ebdc23783f1cfdf98524b65134e26fe6ba0d676f1092cb68d66434716d18fafcf4fd7e8075930486520d980c7
SSDeep	24576:RsmXtloYJgVoXvxNQBj9IxBi2VV2YGvt5Vw2LkyxHku7hyZBz4mAxjeQKZn5s:R3XDIUxWKi2v2YGvTV/9kuUYmQjIs
TLSH	7E75129C7510F9EEC497CA318A54EE70E5312DAB9207C313D1EB5EAFBA0C56ACE141E1

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Refu.exe
Full Name	Refu.exe
EntryPoint	System.Void NetworkSniffer.Program::Main()
Scope Name	Refu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Refu
Assembly Version	7.6.4.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	1
Main Method	System.Void NetworkSniffer.Program::Main()
Main IL Instruction Count	43
Main IL	nop <null> call System.Void NetworkSniffer.Program::‎⁪⁮⁭⁬‌‪⁪‬⁭⁪⁪⁬‮‬‍‌‬⁫⁯‍⁯‪⁯⁫‏⁬‮‭‪‌⁮⁪⁬⁯‍‭‮() ldc.i4 -1395711918 ldc.i4 -1518991661 xor <null> dup <null> stloc.0 <null> ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0082: nop nop <null> ldloc.0 <null> ldc.i4 -402782889 mul <null> ldc.i4 1906430239 xor <null> br.s IL_000B: ldc.i4 -1518991661 nop <null> ldloc.0 <null> ldc.i4 1047961363 mul <null> ldc.i4 605746455 xor <null> br.s IL_000B: ldc.i4 -1518991661 ldc.i4.0 <null> call System.Void NetworkSniffer.Program::‏⁯⁫‎⁬⁬⁫⁮⁮⁫‏‌‍‎⁮‏⁪‌⁭‪⁯⁪‬‮⁮‬⁭‎‏⁮⁮‍‎⁫‫‫‭⁯⁫‏‮(System.Boolean) ldloc.0 <null> ldc.i4 894899085 mul <null> ldc.i4 668943220 xor <null> br.s IL_000B: ldc.i4 -1518991661 newobj System.Void NetworkSniffer.MainUI::.ctor() call System.Void NetworkSniffer.Program::‎⁭‬‎⁭‮⁯‎‎⁬‭⁫‏⁫⁬‏⁪‬⁯‮⁭‎‌⁮‮‬⁫‎⁮⁯⁯‏⁫‎‫⁮‮(System.Windows.Forms.Form) ldloc.0 <null> ldc.i4 -1422977223 mul <null> ldc.i4 86620484 xor <null> br.s IL_000B: ldc.i4 -1518991661 nop <null> ret <null>
Module Name	Refu.exe
Full Name	Refu.exe
EntryPoint	System.Void NetworkSniffer.Program::Main()
Scope Name	Refu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Refu
Assembly Version	7.6.4.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	1
Main Method	System.Void NetworkSniffer.Program::Main()
Main IL Instruction Count	43
Main IL	nop <null> call System.Void NetworkSniffer.Program::‎⁪⁮⁭⁬‌‪⁪‬⁭⁪⁪⁬‮‬‍‌‬⁫⁯‍⁯‪⁯⁫‏⁬‮‭‪‌⁮⁪⁬⁯‍‭‮() ldc.i4 -1395711918 ldc.i4 -1518991661 xor <null> dup <null> stloc.0 <null> ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0082: nop nop <null> ldloc.0 <null> ldc.i4 -402782889 mul <null> ldc.i4 1906430239 xor <null> br.s IL_000B: ldc.i4 -1518991661 nop <null> ldloc.0 <null> ldc.i4 1047961363 mul <null> ldc.i4 605746455 xor <null> br.s IL_000B: ldc.i4 -1518991661 ldc.i4.0 <null> call System.Void NetworkSniffer.Program::‏⁯⁫‎⁬⁬⁫⁮⁮⁫‏‌‍‎⁮‏⁪‌⁭‪⁯⁪‬‮⁮‬⁭‎‏⁮⁮‍‎⁫‫‫‭⁯⁫‏‮(System.Boolean) ldloc.0 <null> ldc.i4 894899085 mul <null> ldc.i4 668943220 xor <null> br.s IL_000B: ldc.i4 -1518991661 newobj System.Void NetworkSniffer.MainUI::.ctor() call System.Void NetworkSniffer.Program::‎⁭‬‎⁭‮⁯‎‎⁬‭⁫‏⁫⁬‏⁪‬⁯‮⁭‎‌⁮‮‬⁫‎⁮⁯⁯‏⁫‎‫⁮‮(System.Windows.Forms.Form) ldloc.0 <null> ldc.i4 -1422977223 mul <null> ldc.i4 86620484 xor <null> br.s IL_000B: ldc.i4 -1518991661 nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.