Deep Malware Analysis of 97879c76fc0ef8f0fb78b2be8e440f99 | md5: 97879c76fc0ef8f0fb78b2be8e440f99 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.50

PE Executable

MD5: 97879c76fc0ef8f0fb78b2be8e440f99

Size: 460.29 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	97879c76fc0ef8f0fb78b2be8e440f99
Sha1	bdb371f66716121cb015106bfc6acabd93998a3a
Sha256	4e12323d957c2b29d873e8ac7acd749b18c2f862fdeb28503041ccb1cbac9f22
Sha384	814d4a00bc2dad1338093f346e7948b367f1efe7ddda7a9102776c02f4b632e8f8defb39386d959b8387731ed7ce07f2
Sha512	b53edeb99528740d2ec8f7f8cc9dbe5b0e6bd18e169cd7ada8ad3d713c8849f4b0e2a344ae77fa2523d78add8631eb1c6a40dff3ebccf0b2045b1b893665e268
SSDeep	6144:NAmTWLUrD0QuoxGNqjzXzjgEKA+I74F2d43l9/NTrF9PDZix2dN+F5+Sjw7o95:NAmqThbqjzn1Ktb3l7vDkx2IFgIUoz
TLSH	09A4012877AACA06D6B647B406B1F07517BA3D8AA931D3164FD97CDFB672F018800B03

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: kwlO.pdb
Module Name	kwlO.exe
Full Name	kwlO.exe
EntryPoint	System.Void ModularExponentiation.Program::Main()
Scope Name	kwlO.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kwlO
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	224
Main Method	System.Void ModularExponentiation.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void ModularExponentiation.Forms.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`
Module Name	kwlO.exe
Full Name	kwlO.exe
EntryPoint	System.Void ModularExponentiation.Program::Main()
Scope Name	kwlO.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kwlO
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	224
Main Method	System.Void ModularExponentiation.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void ModularExponentiation.Forms.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.