Malicious
Malicious

PE Executable
MD5: 890b38c88f9de99f38715e4e7eb66d23
Size: 1.72 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 890b38c88f9de99f38715e4e7eb66d23
Sha1 080c3dc54fe803bef8cf3426a5148633eba85032
Sha256 883deea17e26a18bb9c6a8d5184f6d4d326b84d16c3d43589fb4a7287bfb0dca
Sha384 453121225897f53d4c0c27dc2549a74d63e3e8e7801d22a7826accc527bf19d4cc1805b29c51386425e55f303fca7422
Sha512 3419665c453353ed7b1119fdd460e6064b2b5781eb1ff54c23f003999f0df8aaa8459812f09faa95b0869042586f8cfc72cfb69bdc2aa1bb5c5dc06e49542c01
SSDeep 49152:yvszahIWGB0Xt92N6o7sMI4J2tmLGdJxR:KhIN0XvhSsb
TLSH C9859C027E44CE51F0091633C3EF45484BB9A95166A6E32BBDBA376E15523E73C0DACB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
890b38c88f9de99f38715e4e7eb66d23
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
nJ1iGGYpssiyIE8xx1.IMsFkTUCNUHmSNbJEC
6TcD7khHHYvc4uo2Ct.cV79UEthtpcpqAUqDL
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
Full Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
EntryPoint
System.Void qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::zIeynop9D6()
Scope Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bD4w6vmm7l
Assembly Version
5.1.4.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::zIeynop9D6()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void NydqFfyCerDsLvyEf9p.AiOnKKyhXbSYawW7PWf::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::robyKgF5UG
callvirt System.Void kuIB5TNha7ScjSZr12M.Ii5fK3NfYoe2nymWgY2::qmmI5XlpRl()
nop <null>
ret <null>
Module Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
Full Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
EntryPoint
System.Void qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::zIeynop9D6()
Scope Name
qq66tUL60cDil7HyM3rwNN2ik8z6m0qAvfo
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bD4w6vmm7l
Assembly Version
5.1.4.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::zIeynop9D6()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void NydqFfyCerDsLvyEf9p.AiOnKKyhXbSYawW7PWf::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object qKsWLgNg2INd2Vk5u4V.fsNRZnNrGfcdygeOrhH::robyKgF5UG
callvirt System.Void kuIB5TNha7ScjSZr12M.Ii5fK3NfYoe2nymWgY2::qmmI5XlpRl()
nop <null>
ret <null>
890b38c88f9de99f38715e4e7eb66d23
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
nJ1iGGYpssiyIE8xx1.IMsFkTUCNUHmSNbJEC
6TcD7khHHYvc4uo2Ct.cV79UEthtpcpqAUqDL
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙