Deep Malware Analysis of 91daee5b3324d9b5ae959a397b37cdfb | md5: 91daee5b3324d9b5ae959a397b37cdfb | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.61 | Fody/Costura Packer | PDB Path | SOS: 0.19 | SOS: 0.24 | SOS: 0.20 | SOS: 0.22 | SOS: 0.23 | SOS: 0.34 | SOS: 0.29 | SOS: 0.35 | SOS: 0.25 | SOS: 0.14 | SOS: 0.26 | SOS: 0.32 | SOS: 0.27 | SOS: 0.18 | SOS: 0.15

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	4584
Main Method	System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::oWofUqIOlvQvCMCgKU() newobj System.Void lvfeznzoixvwmpuezskivaqfpx.12FGkADHYAKQet::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	4584
Main Method	System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void lvfeznzoixvwmpuezskivaqfpx.a4OVeTNC6aNI::oWofUqIOlvQvCMCgKU() newobj System.Void lvfeznzoixvwmpuezskivaqfpx.12FGkADHYAKQet::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

protohuhuhuhuhuhuhu

PDB Path PATH

protobhuhuhuhuhuhuhu

PDB Path PATH

Shahuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

Sharphuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential