7c61a6f45733f28e100c5b13f12b0aa6

PE Executable

MD5: 7c61a6f45733f28e100c5b13f12b0aa6

Size: 716.8 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	7c61a6f45733f28e100c5b13f12b0aa6
Sha1	17483d44ef5f95205b136fdcf6c0669437b165af
Sha256	ffa2ef64753d388a36eef4da1fe88cd54a1f823483445c97c016e984bfe85374
Sha384	c907ae151f1f7c598f55517d0503f4b49bbfcc680e48bc0962ef625ff4063c0171956f1b78077d8499662757520b576b
Sha512	1c431f7dc4f581bec26b8c3db6630c63083d48afbab9027b3333633ea6bac3b6941cd2ed029320bd02e96f01bd90d9e5d41beb6c3976aa2e85c692a877a41ba9
SSDeep	12288:30HfLPHe/SsjrtHqUhhePcQsRvS44OyUXDGpwcy++yyC+Qwi13zQBS7g4QCLXDBb:3qfjHe/Nrh5OUXkwcyoPwk3zQBS7gXgt
TLSH	8FE412457209D432E4A46BF564B1D7B653A68E8CF903D3838ED8FDD73AB3F822464681

Name	Value
Module Name	ahzo.exe
Full Name	ahzo.exe
EntryPoint	System.Void DemoSaver.Program::Main(System.String[])
Scope Name	ahzo.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ahzo
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	111
Main Method	System.Void DemoSaver.Program::Main(System.String[])
Main IL Instruction Count	45
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void Game15.Game15::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldarg.0 <null> call DemoSaver.Program/ScreenSaverArgs DemoSaver.Program::ParseSaverArgs(System.String[]) stloc.0 <null> newobj System.Void DemoSaver.ScreenSaverVisualizer::.ctor() stloc.1 <null> ldloc.1 <null> newobj System.Void DemoSaver.ScreenSaverWindow::.ctor(DemoSaver.IScreenSaverVisualizer) stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> ldloc.0 <null> ldfld DemoSaver.Program/ScreenSaverStates DemoSaver.Program/ScreenSaverArgs::SaverMode stloc.s V_4 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr) brfalse.s IL_0082: ldloc.3 ldloc.2 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle callvirt System.Void DemoSaver.ScreenSaverWindow::SetSaverPreviewMode(System.IntPtr) br.s IL_0082: ldloc.3 ldstr No configuration available. ldstr Test Saver call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldloc.3 <null> brfalse.s IL_008B: ret ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

ahhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

ahhuhuhuhu

7c61a6f45733f28e100c5b13f12b0aa6

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.