7bd987f93ce191a3bc8f7590ffe510ff

PE Executable

MD5: 7bd987f93ce191a3bc8f7590ffe510ff

Size: 11.64 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	7bd987f93ce191a3bc8f7590ffe510ff
Sha1	1fff999fddab7c075963e09a0f1155ed76981794
Sha256	c2b078ab7d96bcdb061c34eb88e0d581ff2b8914ac26ab236e63775ebe7949d1
Sha384	8b219df00123c5b044ba47d27622841c70e36305bb9fb68eadeb8ea862f341f6bbf00d4a9329b3401ad677ce56768cdd
Sha512	f91f02e1bdc6d01de5636616a3b119e442b3e8c71138353de8d61b4bcf10f42fa17e1f153a92d1f732691f97fe080d0c1e6001488d601dd077b7be1aab249616
SSDeep	98304:9ukOR43/jppH6wrHA2poBkx5uHTs1DsLHyM59kGudh1NxtHWvhud:BH6wjpAG5uHgOx9kGYhjfHW5u
TLSH	38C64847B2A69439D4970B304C3A951E9BF4BE0ECB1D8D8AB28FFC645732375751B20A

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLL

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5

bin 3img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>html

Shape pe:exe>html

2 nodes

Path pe:exe>pe:exe

Shape pe:exe>pe:exe

2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	`PDB Path: C:\Users\Soubw\Downloads\000 - PRODUCTION\000 - TRAMPOS\003 - SourceCodes\003 - BTMOB\BTMOB-v4.1-Full-SRC-ATM\BTMOB-v4.1-Tool_SRC\BTMOB\obj\Debug\BTMob.pdb`
Module Name	BTMob.exe
Full Name	BTMob.exe
EntryPoint	System.Void BTMOB.My.MyApplication::Main(System.String[])
Scope Name	BTMob.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	BTMob
Assembly Version	4.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	14413
Main Method	System.Void BTMOB.My.MyApplication::Main(System.String[])
Main IL Instruction Count	14
Main IL	nop <null> nop <null> call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering() call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> leave.s IL_0011: nop nop <null> endfinally <null> nop <null> call BTMOB.My.MyApplication BTMOB.My.MyProject::get_Application() ldarg.0 <null> callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[]) nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.