Malicious
Malicious

95172d15d33e8f5c9f1f754e75a9b704

PE Executable
|
MD5: 95172d15d33e8f5c9f1f754e75a9b704
|
Size: 636.42 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
95172d15d33e8f5c9f1f754e75a9b704
Sha1
97bf0af6042d8d51bb463aa2e83f30a8a06f62b6
Sha256
e273d507de113dee244440e6e5bf5a2e0cb285727d789221d7332a0394e00c33
Sha384
e07eb4c65d99a5b80bab2b21882da0de9f0ad04316e5a67299e539df1d7cf8993eaed579bced669525856d1cfd111dde
Sha512
b1b7ef013003c5858a4ceddb94580135f3c04f255b6306239abc2284f3e6dd08c78699d78bf449e1fb8b295410fbd49c0dc9b4554c01bef0f16e8261aa501fc1
SSDeep
12288:d+uAGLFq8Meqkl2dpqZTWr2fe8waeF2/:d+CZMetoaqetf
TLSH
D5D49E2776528F21D3882737D5CB4A0093A49941B5A7F72F758403E229073EADF4A7EB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
95172d15d33e8f5c9f1f754e75a9b704
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
FoEl5EssRVLlQLkiJN.UTgxKYuS85yU7NbQaJ
Hm94TSiLHNNGwMMP2m.cOAv4YtqR9T1wHYCMU
1lR95IA4nEHcFy0ZGr.t6kxmRmryV40m3f7dj
Zhfttbczzg.g.resources
Tmjchdubtb.Properties.Resources.resources
Dlzgeblalq
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Zhfttbczzg.exe
Full Name

Zhfttbczzg.exe
EntryPoint

System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Scope Name

Zhfttbczzg.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Zhfttbczzg
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

43
Main Method

System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Main IL Instruction Count

55
Main IL

ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_00FD: ret nop <null> ldsfld cd6bdlsQLWMKhMCiOQb cd6bdlsQLWMKhMCiOQb::JlFsKB37DY call System.Boolean cd6bdlsQLWMKhMCiOQb::X7dsned8Gm(cd6bdlsQLWMKhMCiOQb) pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_62823a974b4f41f0b1773ca16e6df539 brtrue IL_006A: switch(IL_0086) pop <null> ldc.i4 1 br IL_006A: switch(IL_0086) br IL_0066: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0066: ldloc V_0 br IL_0086: leave IL_00FD leave IL_00FD: ret pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_cba316683284414d97bb18e5f317f88a brtrue IL_00BD: switch(IL_00D9) pop <null> ldc.i4 4 br IL_00BD: switch(IL_00D9) br IL_00B9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00B9: ldloc V_2 br IL_00D9: leave IL_00FD leave IL_00FD: ret ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_10b2dea4fd4f47bca88cc236024e9aac brtrue IL_000D: switch(IL_00FD,IL_002D) pop <null> ldc.i4 5 br IL_000D: switch(IL_00FD,IL_002D) ret <null>
Module Name

Zhfttbczzg.exe
Full Name

Zhfttbczzg.exe
EntryPoint

System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Scope Name

Zhfttbczzg.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Zhfttbczzg
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

43
Main Method

System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Main IL Instruction Count

55
Main IL

ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_00FD: ret nop <null> ldsfld cd6bdlsQLWMKhMCiOQb cd6bdlsQLWMKhMCiOQb::JlFsKB37DY call System.Boolean cd6bdlsQLWMKhMCiOQb::X7dsned8Gm(cd6bdlsQLWMKhMCiOQb) pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_62823a974b4f41f0b1773ca16e6df539 brtrue IL_006A: switch(IL_0086) pop <null> ldc.i4 1 br IL_006A: switch(IL_0086) br IL_0066: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0066: ldloc V_0 br IL_0086: leave IL_00FD leave IL_00FD: ret pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_cba316683284414d97bb18e5f317f88a brtrue IL_00BD: switch(IL_00D9) pop <null> ldc.i4 4 br IL_00BD: switch(IL_00D9) br IL_00B9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00B9: ldloc V_2 br IL_00D9: leave IL_00FD leave IL_00FD: ret ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_10b2dea4fd4f47bca88cc236024e9aac brtrue IL_000D: switch(IL_00FD,IL_002D) pop <null> ldc.i4 5 br IL_000D: switch(IL_00FD,IL_002D) ret <null>
95172d15d33e8f5c9f1f754e75a9b704 (636.42 KB)
File Structure
95172d15d33e8f5c9f1f754e75a9b704
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
FoEl5EssRVLlQLkiJN.UTgxKYuS85yU7NbQaJ
Hm94TSiLHNNGwMMP2m.cOAv4YtqR9T1wHYCMU
1lR95IA4nEHcFy0ZGr.t6kxmRmryV40m3f7dj
Zhfttbczzg.g.resources
Tmjchdubtb.Properties.Resources.resources
Dlzgeblalq
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙