Deep Malware Analysis of 8475901ea9c5894d32d8c373975d0aa9 | md5: 8475901ea9c5894d32d8c373975d0aa9 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.61 | Fody/Costura Packer | PDB Path | SOS: 0.19 | SOS: 0.24 | SOS: 0.15 | SOS: 0.25 | SOS: 0.22 | SOS: 0.18 | SOS: 0.20 | SOS: 0.23 | SOS: 0.34 | SOS: 0.29 | SOS: 0.35 | SOS: 0.14 | SOS: 0.26 | SOS: 0.32 | SOS: 0.27

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

PeID

HQR data fileMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	4584
Main Method	System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::llwmoOlbYFCJ() newobj System.Void yaemsbvxlgwndvyaopkrjhusrvht.q34YeATIBUz3Bm86QMz1Z::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	4584
Main Method	System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void yaemsbvxlgwndvyaopkrjhusrvht.S3NNuy6TeD2F9IGqVQrJ::llwmoOlbYFCJ() newobj System.Void yaemsbvxlgwndvyaopkrjhusrvht.q34YeATIBUz3Bm86QMz1Z::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

protohuhuhuhuhuhuhu

PDB Path PATH

protobhuhuhuhuhuhuhu

PDB Path PATH

Shahuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

Sharphuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential