Malicious
Malicious

PE Executable
MD5: 94559c76a505cf75b1b4682d9a8038e8
Size: 1.74 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 94559c76a505cf75b1b4682d9a8038e8
Sha1 073972e950c6c2c8d020bec74ba36eb855be5013
Sha256 807f17e494839874f50bc0ba2f65991825199a8e25bb5fad4e8a347bcc48e5c6
Sha384 284d63ae1bcf5b4dfd899871f217f717d88323b923610e36f4ea37d27bfab193d843b2a8a8997356b5010b21e4522361
Sha512 6d3ebd410ab5a2d064ea51706d4e770457305a0ed0116eae0af1ce7feed920ad90540beabb6a38909243ca84c9cf4eb4a9c7f973300124cc067952db41c30dd3
SSDeep 24576:OEtKtr9t1QhA6l6rt3DCAvXuQJLEW8ef1XQyNG6GRUBlQ6owJtoTzVxou2CC8Adt:bKtFEYX2EIotgEG6XlQLwJONig
TLSH F0859C027F548E11F1191237E2EF89484BB4D94166AAE32B7DBE336E95123973C0D9CB
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
94559c76a505cf75b1b4682d9a8038e8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
SJWi7OvvcP9q3vmTh4.IDf5Y78BAWYuZ3Pcva
6xLnhQJqc3Z5in3urd.5HOQxW4PRG0xYyTSma
Name Value
Module Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
Full Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
EntryPoint
System.Void ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::gdqrhh3Pyn()
Scope Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7GxHjd7
Assembly Version
0.2.7.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::gdqrhh3Pyn()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void L75adcHaHNqwIjAroM2.YmpoQsHgMjv7QEsNYRW::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::yVIrdQKAe5
callvirt System.Void x1wqhsqgRkW5pMJtF2H.PQ0Wvvq4MylmP4h8wen::EOyJNytUEc()
nop <null>
ret <null>
Module Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
Full Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
EntryPoint
System.Void ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::gdqrhh3Pyn()
Scope Name
8caZZTvKSdxw2NL1NwI6Lg0MjuLlGoBVh7m0HlTNRnlh
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7GxHjd7
Assembly Version
0.2.7.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::gdqrhh3Pyn()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void L75adcHaHNqwIjAroM2.YmpoQsHgMjv7QEsNYRW::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object ttkVtVqVhgCWlCe1B9S.gJE027qAeRRUBZvdwlO::yVIrdQKAe5
callvirt System.Void x1wqhsqgRkW5pMJtF2H.PQ0Wvvq4MylmP4h8wen::EOyJNytUEc()
nop <null>
ret <null>
94559c76a505cf75b1b4682d9a8038e8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
SJWi7OvvcP9q3vmTh4.IDf5Y78BAWYuZ3Pcva
6xLnhQJqc3Z5in3urd.5HOQxW4PRG0xYyTSma
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙