Deep Malware Analysis of 7a0e83e0e040cc7431ad73b416196b72 | md5: 7a0e83e0e040cc7431ad73b416196b72 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.22

PE Executable

MD5: 7a0e83e0e040cc7431ad73b416196b72

Size: 747.01 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	7a0e83e0e040cc7431ad73b416196b72
Sha1	35aff4c4f46824f51d0be16739c593d91e22a08e
Sha256	6d0143dd66ca4f5b6d342c88feb3a564c81e18e3db7805c85e7f5895acb059bb
Sha384	1edc4716bbb69aa13c2c14e7f2c93d92a97701a716b237f2e572425884bd06882eea798b0946df12b20d0ef7bba52876
Sha512	ae2d82429905f8eebf03cc9d9714636560e5f597998e8c390882b94a6c0663fd2c6590d8832cf9c976630556639be0212ca0b369f6d974699df720a3f5c1de4c
SSDeep	12288:OoyfLPHe/bJEfPATO26Td8zOJMrhqET53M0TZQgF/HfSEH2DKByf:OPfjHe/bJEnAC2gd84MrYK3M0ZJ1Hfd2
TLSH	08F412447109D812D8716FB465A1D3B612BA8E9EFC07E383ACDCFCA77B7B7821156281

Name	Value
Module Name	Uxmu.exe
Full Name	Uxmu.exe
EntryPoint	System.Void DemoSaver.Program::Main(System.String[])
Scope Name	Uxmu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Uxmu
Assembly Version	2.8.5.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	111
Main Method	System.Void DemoSaver.Program::Main(System.String[])
Main IL Instruction Count	45
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void Game15.Game15::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldarg.0 <null> call DemoSaver.Program/ScreenSaverArgs DemoSaver.Program::ParseSaverArgs(System.String[]) stloc.0 <null> newobj System.Void DemoSaver.ScreenSaverVisualizer::.ctor() stloc.1 <null> ldloc.1 <null> newobj System.Void DemoSaver.ScreenSaverWindow::.ctor(DemoSaver.IScreenSaverVisualizer) stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> ldloc.0 <null> ldfld DemoSaver.Program/ScreenSaverStates DemoSaver.Program/ScreenSaverArgs::SaverMode stloc.s V_4 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr) brfalse.s IL_0082: ldloc.3 ldloc.2 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle callvirt System.Void DemoSaver.ScreenSaverWindow::SetSaverPreviewMode(System.IntPtr) br.s IL_0082: ldloc.3 ldstr No configuration available. ldstr Test Saver call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldloc.3 <null> brfalse.s IL_008B: ret ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

Uxhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

Uxhuhuhuhu

7a0e83e0e040cc7431ad73b416196b72

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.