Suspicious
Suspect

PE Executable
MD5: 71f48d2ad7bf33453235cbef0c433006
Size: 3.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 71f48d2ad7bf33453235cbef0c433006
Sha1 9041f986b46e0db661f39616c59713e147768cd2
Sha256 7805a1e88a2164f755febc4db00d53851f72e8dcaacfe1742c7e2abecdd09b6c
Sha384 28166be75a9daa7b8aa35d5c2b5d972dd2024d302d3f73c7a08a69fd66ecd28a00cb77190cf6aefb2ec07a082e0b51fa
Sha512 ecd27d8417892738a87cfa4200f03417cdf9456b8508244c67f00a9f73555210aacbbacedf49415f16cf35ed732bd89ece9fede5825785ca023db8d2943f719c
SSDeep 49152:jv6e821/aQWl8P0lSk3aKA3Z+nMREt0mz7doGd7THHB72eh2NT:jvR821/aQWl8P0lSk3DA3Z+nMREtr
TLSH 27E55A0537F85E62E16BD3B2D5F0541363F0F86AF3A3EB0B6191677A1C93B4098426A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
71f48d2ad7bf33453235cbef0c433006
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client
Full Name
Client
EntryPoint
System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::搋넅઺䛣螦Ԡﵨꔲ侵ᡎ텔편ᩤ䡴렎㛤亗버᧣鞌(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::ꕉ䱈呫붨+况儢Ụ璱뾚铁ڞ态ົ挓椽숰風鵯胢(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 燔싐쇒墒䂞ઙ荪أ鐸聴촺鑗囤꧛�ܹ콁셬巾::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::搋넅઺䛣螦Ԡﵨꔲ侵ᡎ텔편ᩤ䡴렎㛤亗버᧣鞌(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 瞤⨢붫�顒�籪씉픊邒냴፹㱦␿问팽::ꕉ䱈呫붨+况儢Ụ璱뾚铁ڞ态ົ挓椽숰風鵯胢(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 燔싐쇒墒䂞ઙ荪أ鐸聴촺鑗囤꧛�ܹ콁셬巾::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
71f48d2ad7bf33453235cbef0c433006
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙