Malicious
Malicious

PE Executable
MD5: 96fcb717c20c4e1629883d7bc366794f
Size: 1.19 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 96fcb717c20c4e1629883d7bc366794f
Sha1 4f06e5ec4234031b67889afcba11cddaa7b2115d
Sha256 8635b498be98d750486f1a5e832bb862fe8c2248e983435546459bf101632221
Sha384 351d8fd88a1de229be1ff21ab243b7af21e0fb016f1327540cd65c750737b03e786388093baac5a0c5b0a3cc1958aa01
Sha512 56037e13339873710c672c68f584aa1e6a2682248993a679b93ae07ad3e7f51d93c09e078d1e5c25a58fbca6869040fd2c363f8af43e95da5c9ed4cb00d092c6
SSDeep 24576:zKvNRRk656mvI/1mBnUjJB4j3ST6rlcAqpJ/jk:zgT60qjJGCTAqxr
TLSH 7E456B027E04CE11F0091633C2EF558897B0A95166E6E72B7DBA377EA5123A77C0D9CB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
96fcb717c20c4e1629883d7bc366794f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
UXqg20qvvkkSADIvYn.NwIfDyuNAIFncewEgg
s5Ul4qAsq2u98Z1kOX.PSBF5DVU6xqxAbyn7A
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Do03VJjL
Full Name
Do03VJjL
EntryPoint
System.Void QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::avP3vCgK15()
Scope Name
Do03VJjL
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
E1xL1EEKWe7cxVUIZYLkkwbgh2ifWda
Assembly Version
3.6.2.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::avP3vCgK15()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void VNbYaqtUrTlqCV5iQT7.wqr3E0thFd0dwdXsSxO::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::gef3Khp5yw
callvirt System.Void uTrYGjKhufFB59VB0ir.eJ8rAvKQPAmGYq3oW2C::QSmd9IuXKl()
nop <null>
ret <null>
Module Name
Do03VJjL
Full Name
Do03VJjL
EntryPoint
System.Void QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::avP3vCgK15()
Scope Name
Do03VJjL
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
E1xL1EEKWe7cxVUIZYLkkwbgh2ifWda
Assembly Version
3.6.2.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::avP3vCgK15()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void VNbYaqtUrTlqCV5iQT7.wqr3E0thFd0dwdXsSxO::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object QJKKTAKbkioBv0vyQXq.udAKeRKwnLG9dPKVGhk::gef3Khp5yw
callvirt System.Void uTrYGjKhufFB59VB0ir.eJ8rAvKQPAmGYq3oW2C::QSmd9IuXKl()
nop <null>
ret <null>
96fcb717c20c4e1629883d7bc366794f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
UXqg20qvvkkSADIvYn.NwIfDyuNAIFncewEgg
s5Ul4qAsq2u98Z1kOX.PSBF5DVU6xqxAbyn7A
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙