7277b777e4e2b221658d609869da9077

PE Executable

MD5: 7277b777e4e2b221658d609869da9077

Size: 97.79 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	7277b777e4e2b221658d609869da9077
Sha1	3057b635fa4980e044e7c6ff20b9a5294b615f4c
Sha256	f992a32c5324aef65465eb1566532c523f42ed71a2a2f8f6d026ded6ea8ac3a3
Sha384	06a4774960423512155ea14217327e3d073aaa65a23306280369e668a38807ef0a28222cf96ca333edd459ab27c9a3d4
Sha512	b801864ea9ce06d0efadb9816a64dd644787786add8276594353f72c5d34cf8c58e183ff1dd61577adc6ee1fd9ae49dda2520f4ec9bca695a2709b2125ab2e22
SSDeep	1536:xqskjlqzWlbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed2D3teulgS6pk:fYUeYr+zi0ZbYe1g0ujyzd/k
TLSH	4EA35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC164E71FA7B866957EF2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
[Configuration Module Name]	Enthuhuhuhu
[Configuration Module Full Name]	Enthuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Happy.exe
Full Name	Happy.exe
EntryPoint	System.Void Program::Main(System.String[])
Scope Name	Happy.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Happy
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	234
Main Method	System.Void Program::Main(System.String[])
Main IL Instruction Count	3
Main IL	`newobj System.Void EntryPoint::.ctor() call System.Void Program::Execute(EntryPoint) ret <null>`
Module Name	Happy.exe
Full Name	Happy.exe
EntryPoint	System.Void Program::Main(System.String[])
Scope Name	Happy.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Happy
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	234
Main Method	System.Void Program::Main(System.String[])
Main IL Instruction Count	3
Main IL	`newobj System.Void EntryPoint::.ctor() call System.Void Program::Execute(EntryPoint) ret <null>`

Config. Field	Value
[Configuration Module Name]	Enthuhuhuhu
[Configuration Module Full Name]	Enthuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

You must be signed in to view YARA rules.