Malicious
Malicious

PE Executable
MD5: 8eb9956d084b2bfd7c6713379b27831b
Size: 1.44 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8eb9956d084b2bfd7c6713379b27831b
Sha1 22edaf586db95598e4cd7017be699c2ebdb12199
Sha256 ab8fbd127119c511a07082e0966dc9e70e8e8e01a2f054ae3d2f39752ff4fdb8
Sha384 c5e95ce0fc3262a659dbe97fa6b07bb50c2607982be08c0fb79b23015d4b3c1bf7d74cde74cd8c03c12eb62596669140
Sha512 2020cd969b9386f20656f531c65f78b55f3de1ff83452737c924e8537e022e0a5204072288d69e67dc50b864c0227f1ea99409e55d6a4e2763cedb7180b2392e
SSDeep 24576:90PqFJpZijz3SvHLT7fJqxbA89DGRkE/uY5+VvF/y:90kpZiG0xb1a9EvN
TLSH 20656B423A14CD56F0142333C2EF548897F2BC412AAAE717B9BB776E94513A33C6D58B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8eb9956d084b2bfd7c6713379b27831b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
6hVKbmZp8W5Yk64iXW.MTMCOjWSm48hsgOohW
iVlAm5d9TTQpqKeBe7.P6IUJPxCubimb23KGP
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
Full Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
EntryPoint
System.Void wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::rEQlrZn1wj()
Scope Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Z87yCzoi
Assembly Version
8.1.8.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::rEQlrZn1wj()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void Y9BujMl0psihgERxxUB.ycqquJli3tvS2uJZcjm::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::KImlDCIhKn
callvirt System.Void PViAvqBiFqwTueO9x7T.rH5ObsBVTPlgKW23OB4::zXRxW2m6Ck()
nop <null>
ret <null>
Module Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
Full Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
EntryPoint
System.Void wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::rEQlrZn1wj()
Scope Name
lkre9vJ3eXr3EbRsZr0axUadPEOadCR
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Z87yCzoi
Assembly Version
8.1.8.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::rEQlrZn1wj()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void Y9BujMl0psihgERxxUB.ycqquJli3tvS2uJZcjm::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object wVWE0fB3icUaWFAJ7PO.uBbMbMBn5tWeY8GLm3V::KImlDCIhKn
callvirt System.Void PViAvqBiFqwTueO9x7T.rH5ObsBVTPlgKW23OB4::zXRxW2m6Ck()
nop <null>
ret <null>
8eb9956d084b2bfd7c6713379b27831b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
6hVKbmZp8W5Yk64iXW.MTMCOjWSm48hsgOohW
iVlAm5d9TTQpqKeBe7.P6IUJPxCubimb23KGP
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙