Suspicious
Suspect

PE Executable
MD5: 7710fc4511a1bd6e7f5cf7ae58da300e
Size: 732.16 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 7710fc4511a1bd6e7f5cf7ae58da300e
Sha1 deb333fef9664ad345c137995271dad863ee1956
Sha256 17b4b64cc0981196a5e53ef62d692b39af394ad5de609a76bb3d4dfb5efa979f
Sha384 00bc3b316e16db918a69f8590575040c7661f7d110170da1dd68dcc35db3eb547e1cd4006e170f04a7e5622f7a15f2a0
Sha512 bc4b7dde7448f4cb9cd6174ff0de400e1e73f0826e3769ac52eed7640a7ff5e66e9e28953fc39c744837ecfefaaabe53a8e9485b4d0eef269598c2ffaa6bae5d
SSDeep 12288:10TlE/roSUdKxuNHK67OUXEsJCW4AIjXLzuhruQSujyFIERc:v/kfd1HK6/XZfSLwpSujyC
TLSH 7CF4BF1523D84B68F8BFE7387439511587F2F81E9722EA2EAF5950E90825F4CC662733
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
7710fc4511a1bd6e7f5cf7ae58da300e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
jBd60pJbqj1K3.g.resources
jBd60pJbqj1K3.Resources.resources
88ea1953f75c64.Resources.resources
309f9f5d0
[NBF]root.Data
309f9f5d1
[NBF]root.Data
309f9f5d2
[NBF]root.Data
309f9f5d3
[NBF]root.Data
309f9f5d4
[NBF]root.Data
309f9f5d5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
jBd60pJbqj1K3
Full Name
jBd60pJbqj1K3
EntryPoint
System.Void jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az::Dfa2oM8q3ndG()
Scope Name
jBd60pJbqj1K3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
jBd60pJbqj1K3
Assembly Version
20.18.49.270
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
894
Main Method
System.Void jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az::Dfa2oM8q3ndG()
Main IL Instruction Count
89
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Capnogramat
call System.Boolean jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az/4Gko_.0oiWtdN8::8SbbZqo5r3B(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0020: ldc.r8 25
leave IL_00E4: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldstr /
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 942361
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] jBd60pJbqj1K3.ESOPAdmin.9Ck_o5mE0oRqd/Sbp60.Tob53QbsEto2::ai1X2bLmjJp7G(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_008C: ldloc.s V_5
leave.s IL_00E4: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] jBd60pJbqj1K3.Gbi6s2mA/qk0FoKj1.Hi3qa2zGeA7::5CprawA4Wq3e7s(System.Byte[])
stelem.ref <null>
ldstr L o a d
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object jBd60pJbqj1K3.iKx30dA::aNs9_6Dt(System.String,System.Object)
pop <null>
ldstr Loader
ldstr Success
call System.Void jBd60pJbqj1K3.iKx30dA/yLz4A3poaF7b.jk5KSkt4q8dPx::oQe3Ak2qrC(System.String,System.String)
nop <null>
leave.s IL_00E3: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E3: nop
nop <null>
ret <null>
Module Name
jBd60pJbqj1K3
Full Name
jBd60pJbqj1K3
EntryPoint
System.Void jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az::Dfa2oM8q3ndG()
Scope Name
jBd60pJbqj1K3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
jBd60pJbqj1K3
Assembly Version
20.18.49.270
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
894
Main Method
System.Void jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az::Dfa2oM8q3ndG()
Main IL Instruction Count
89
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Capnogramat
call System.Boolean jBd60pJbqj1K3.6Tcpa1_SxB2n7/gz7Y3Qrdk.iMe9Ep3az/4Gko_.0oiWtdN8::8SbbZqo5r3B(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0020: ldc.r8 25
leave IL_00E4: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldstr /
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 942361
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] jBd60pJbqj1K3.ESOPAdmin.9Ck_o5mE0oRqd/Sbp60.Tob53QbsEto2::ai1X2bLmjJp7G(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_008C: ldloc.s V_5
leave.s IL_00E4: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] jBd60pJbqj1K3.Gbi6s2mA/qk0FoKj1.Hi3qa2zGeA7::5CprawA4Wq3e7s(System.Byte[])
stelem.ref <null>
ldstr L o a d
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object jBd60pJbqj1K3.iKx30dA::aNs9_6Dt(System.String,System.Object)
pop <null>
ldstr Loader
ldstr Success
call System.Void jBd60pJbqj1K3.iKx30dA/yLz4A3poaF7b.jk5KSkt4q8dPx::oQe3Ak2qrC(System.String,System.String)
nop <null>
leave.s IL_00E3: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E3: nop
nop <null>
ret <null>
7710fc4511a1bd6e7f5cf7ae58da300e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
jBd60pJbqj1K3.g.resources
jBd60pJbqj1K3.Resources.resources
88ea1953f75c64.Resources.resources
309f9f5d0
[NBF]root.Data
309f9f5d1
[NBF]root.Data
309f9f5d2
[NBF]root.Data
309f9f5d3
[NBF]root.Data
309f9f5d4
[NBF]root.Data
309f9f5d5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙