Malicious
Malicious

PE Executable
MD5: 80d320adec4526ead82f49e5f71d834f
Size: 1.63 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 80d320adec4526ead82f49e5f71d834f
Sha1 747e36b2292fa8ca1cbd529f8f983dc98b08d098
Sha256 4b3c55405763bd70c67aa1be3a5ff64ec09c0255d6151e94bfef3b230c295aa0
Sha384 0743d6b073aeed209134e8775e08359474e6fc165960c9b27e64927bd60db94bf2ee4465f54c72a621fb170f10ecb7a6
Sha512 ab7841ee8c210b3bfe61621281b4e13db6a3098a6d0aad9bdb70aa2d0adfcf03a288684a5fe36fefd4b04d3ee3578e1926adf2d349b96681fff10202508d7b36
SSDeep 24576:N+cF9gNZfPpZaHvU6kkdbJLpnjLwT+cYls+nLsc/S61cLT:wcF9gNjZWvbw3OgYSmc
TLSH 58759E467E84CE91F0191673D1DF820847B09D516AA6E72BBEAE337D15123A73C0E9CB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
80d320adec4526ead82f49e5f71d834f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
ZlYhEpVhtiTeNAXNWW.QQvcgfRTiUuL8M6HIp
mF1JaV5mvC0kuU8afo.v2ggO4ppGUS8pnkser
Name Value
Module Name
5GOIrM5dY4U
Full Name
5GOIrM5dY4U
EntryPoint
System.Void T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::KZfa2YjxEO()
Scope Name
5GOIrM5dY4U
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
6gLcF3I0ma
Assembly Version
4.7.6.5
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::KZfa2YjxEO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void k9fKJ2aBuo9TdI3Ck77.z6ZZ43a6uOoZJUEIlvV::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::vb9a8sMbNM
callvirt System.Void IMOoW7T6nn6S7f3EiR7.jDeuJXTh3aRw297f5De::ljQsvVycFe()
nop <null>
ret <null>
Module Name
5GOIrM5dY4U
Full Name
5GOIrM5dY4U
EntryPoint
System.Void T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::KZfa2YjxEO()
Scope Name
5GOIrM5dY4U
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
6gLcF3I0ma
Assembly Version
4.7.6.5
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::KZfa2YjxEO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void k9fKJ2aBuo9TdI3Ck77.z6ZZ43a6uOoZJUEIlvV::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object T5wPm2TqiTGfr8ukXtg.mtsO3RT7ajJepxdX1r9::vb9a8sMbNM
callvirt System.Void IMOoW7T6nn6S7f3EiR7.jDeuJXTh3aRw297f5De::ljQsvVycFe()
nop <null>
ret <null>
80d320adec4526ead82f49e5f71d834f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
ZlYhEpVhtiTeNAXNWW.QQvcgfRTiUuL8M6HIp
mF1JaV5mvC0kuU8afo.v2ggO4ppGUS8pnkser
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙