73bf9f699e6a5c45c03c012ab7084ac1

PE Executable

MD5: 73bf9f699e6a5c45c03c012ab7084ac1

Size: 1.62 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	73bf9f699e6a5c45c03c012ab7084ac1
Sha1	af7d08b1d73302f0377708f76ecfb42f39efc795
Sha256	ae758d96c96f29cb36176d98d668716e443e7db062e4d0c9d976b52dbc567bce
Sha384	5122507428359ee1f0795c486fb36d439bc185a124d022d0c54dc79768a1990d68a9cf7367c5323e8cde4156d95daff6
Sha512	a94497e1a07514e9b3100dfe122eb22f0c31d9cd44c26ba9208adac39eaee2ad35d9cb0db2f3980a10943dbe786d40850882eddd3c326e6b478c345e2803432d
SSDeep	24576:1LqJyT+XknkSp/IstmvBx1snWvyr7y+U19s3N6UFE9FLhb+211S+TXIu+pZ:pqkT+0nvIGmvBPyyb1964UkFb1jy
TLSH	F275012117E89A14F0BF8B399471111187F1F907D63ADB0CBA5981EE2DB2BC1E967363

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Module Name	jn4MiHz3
Full Name	jn4MiHz3
EntryPoint	System.Void jn4MiHz3.0ocHoEx5c_8M::rCi0N2ykek()
Scope Name	jn4MiHz3
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	jn4MiHz3
Assembly Version	20.2.48.108
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	945
Main Method	System.Void jn4MiHz3.0ocHoEx5c_8M::rCi0N2ykek()
Main IL Instruction Count	82
Main IL	nop <null> nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.0 <null> ldstr Capnogramat call System.Boolean jn4MiHz3.0ocHoEx5c_8M/4Tebf5jW.0Hywe1/gi4GPfd9y.cMm61bwNp0::1JerS(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_0020: ldc.r8 25 leave IL_00CC: ret ldc.r8 25 call System.Double System.Math::Abs(System.Double) call System.Double System.Math::Round(System.Double) conv.ovf.i4 <null> stloc.1 <null> ldtoken System.Object call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldloc.1 <null> call System.Array System.Array::CreateInstance(System.Type,System.Int32) castclass System.Object[] stloc.2 <null> ldstr / ldc.i4.2 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr resources stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr ghodrahina.png stelem.ref <null> call System.String System.String::Join(System.String,System.String[]) stloc.3 <null> ldloc.2 <null> ldc.i4.0 <null> ldloc.3 <null> stelem.ref <null> newobj System.Void System.Windows.Forms.Panel::.ctor() stloc.s V_4 ldloc.3 <null> call System.Byte[] jn4MiHz3.1fsAs::Fj6d8Wwzo(System.String) stloc.s V_5 ldloc.s V_5 ldnull <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_008C: ldloc.2 leave.s IL_00CC: ret ldloc.2 <null> ldc.i4.2 <null> ldloc.s V_5 stelem.ref <null> ldloc.2 <null> ldc.i4.3 <null> ldloc.s V_5 call System.Byte[] jn4MiHz3.jLc43aCapF6y::2qmMxoL8Wa0g(System.Byte[]) stelem.ref <null> ldstr L o a d stloc.s V_6 ldloc.s V_6 ldloc.2 <null> ldc.i4.3 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Object jn4MiHz3.7XsrFm6c9::Rq3mx0Ss4zeNe(System.String,System.Object) pop <null> leave.s IL_00CB: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: nop nop <null> ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	jn4MiHz3
Full Name	jn4MiHz3
EntryPoint	System.Void jn4MiHz3.0ocHoEx5c_8M::rCi0N2ykek()
Scope Name	jn4MiHz3
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	jn4MiHz3
Assembly Version	20.2.48.108
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	945
Main Method	System.Void jn4MiHz3.0ocHoEx5c_8M::rCi0N2ykek()
Main IL Instruction Count	82
Main IL	nop <null> nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.0 <null> ldstr Capnogramat call System.Boolean jn4MiHz3.0ocHoEx5c_8M/4Tebf5jW.0Hywe1/gi4GPfd9y.cMm61bwNp0::1JerS(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_0020: ldc.r8 25 leave IL_00CC: ret ldc.r8 25 call System.Double System.Math::Abs(System.Double) call System.Double System.Math::Round(System.Double) conv.ovf.i4 <null> stloc.1 <null> ldtoken System.Object call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldloc.1 <null> call System.Array System.Array::CreateInstance(System.Type,System.Int32) castclass System.Object[] stloc.2 <null> ldstr / ldc.i4.2 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr resources stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr ghodrahina.png stelem.ref <null> call System.String System.String::Join(System.String,System.String[]) stloc.3 <null> ldloc.2 <null> ldc.i4.0 <null> ldloc.3 <null> stelem.ref <null> newobj System.Void System.Windows.Forms.Panel::.ctor() stloc.s V_4 ldloc.3 <null> call System.Byte[] jn4MiHz3.1fsAs::Fj6d8Wwzo(System.String) stloc.s V_5 ldloc.s V_5 ldnull <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_008C: ldloc.2 leave.s IL_00CC: ret ldloc.2 <null> ldc.i4.2 <null> ldloc.s V_5 stelem.ref <null> ldloc.2 <null> ldc.i4.3 <null> ldloc.s V_5 call System.Byte[] jn4MiHz3.jLc43aCapF6y::2qmMxoL8Wa0g(System.Byte[]) stelem.ref <null> ldstr L o a d stloc.s V_6 ldloc.s V_6 ldloc.2 <null> ldc.i4.3 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Object jn4MiHz3.7XsrFm6c9::Rq3mx0Ss4zeNe(System.String,System.Object) pop <null> leave.s IL_00CB: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: nop nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.