Malicious
Malicious

PE Executable
MD5: 88cbc1884a9a864844fafcbdd4a06a7b
Size: 1.28 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 88cbc1884a9a864844fafcbdd4a06a7b
Sha1 8f1d95a03ed93bd7a968c9e69d682dc8f872163c
Sha256 5e77f11a0205bd6b936833eeb03135df7d6de1d6bd8490e32c6843d89cd9023f
Sha384 a85dfc21594f5b840024c7af61bdb7d70215d71642b21a452cc86190e028d3277b8a62885948629ecd8eecf0ae68525d
Sha512 8f795d108162be869cd85a4f6ca0d5da8a026b31dde5cd7a8dfec8b316e1d1cbc285019a58a6a5249aa8dbb30bc81f27387d76c5e40554cec059e913cac24a0c
SSDeep 24576:5z9xpu6KPJuvzDW/GKweOyfCTP9tU6OKLhyYdrDb0Feu:5zMQxQ8a6jgwXQF
TLSH 55456B01BE44CE11F0891A33D3FF46484BB099516AA6E32B7DBA37AD16123973C1D9DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
88cbc1884a9a864844fafcbdd4a06a7b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
pWc54I7A03LyqI7vDe.6isGuYhayg6rWuUcIt
ZFvSkaW7VG1NPEDEVO.WwSevwDXdnL7yvwgUJ
Name Value
Module Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
Full Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
EntryPoint
System.Void yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::IVBQeFKHxx()
Scope Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RGbnog
Assembly Version
0.2.9.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::IVBQeFKHxx()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void cA37RAdx2mFPt3eYLZR.sDaMnbdGKi2weSy3XIk::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::bF6QUGSvey
callvirt System.Void candiaYG4fuevfm9C3H.nu8VdVY7TlKEpFqEZkG::N2VJRCRkp6()
nop <null>
ret <null>
Module Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
Full Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
EntryPoint
System.Void yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::IVBQeFKHxx()
Scope Name
aQRmE5AUV8wvifFHm7lVpdAQeg6lGV8QRQig1oXvITQu
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RGbnog
Assembly Version
0.2.9.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::IVBQeFKHxx()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void cA37RAdx2mFPt3eYLZR.sDaMnbdGKi2weSy3XIk::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object yfXEwxYrtujDk1CedXV.Ey0E0AYgcBoRa4hGydE::bF6QUGSvey
callvirt System.Void candiaYG4fuevfm9C3H.nu8VdVY7TlKEpFqEZkG::N2VJRCRkp6()
nop <null>
ret <null>
88cbc1884a9a864844fafcbdd4a06a7b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
pWc54I7A03LyqI7vDe.6isGuYhayg6rWuUcIt
ZFvSkaW7VG1NPEDEVO.WwSevwDXdnL7yvwgUJ
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙