Suspicious
Suspect

PE Executable
MD5: 98b741acd352a8a48fcc8f7c94b0502e
Size: 1.16 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 98b741acd352a8a48fcc8f7c94b0502e
Sha1 58585889116f7889fcbdfe79bfdaa659aaf78e81
Sha256 238441c6a05dd55e6cee3b33c991a8d91302c9e687e4607f2b33ca74dc850ea5
Sha384 a0cf4964ad6431369cd9978ad10560f5aab5e35a6f87d5389a232b2da2f9966c2b279364810aa181995b949167279ca9
Sha512 75ef5c37e470630d6c6084821149ead58c036167a59366c1bc82387ffbd2b61ced046c90e0553e1c9552b61f250daee3462a1e531411c4595498965177bcd28c
SSDeep 12288:WuHN6JaLZokGOuXJxNB3+MLi6bvar5vknJlZelegsUPr3AMMSUqf1GFzO21KObA5:WglLZoNOYwMW9UwljzAE30L1KObz4L
TLSH 5135E0060EC32B94D1594F7CD2A610A877F0D55B9212E76F2FED42F0EEA7B4AC906463
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
98b741acd352a8a48fcc8f7c94b0502e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
xSm4Fg.Resources.resources
xSm4Fg.g.resources
30866e83b6aec0.Resources.resources
1f16a5340
[NBF]root.Data
1f16a5341
[NBF]root.Data
1f16a53410
[NBF]root.Data
1f16a53411
[NBF]root.Data
1f16a53412
[NBF]root.Data
1f16a53413
[NBF]root.Data
1f16a53414
[NBF]root.Data
1f16a53415
[NBF]root.Data
1f16a53416
[NBF]root.Data
1f16a53417
[NBF]root.Data
1f16a53418
[NBF]root.Data
1f16a53419
[NBF]root.Data
1f16a5342
[NBF]root.Data
1f16a53420
[NBF]root.Data
1f16a53421
[NBF]root.Data
1f16a53422
[NBF]root.Data
1f16a53423
[NBF]root.Data
1f16a53424
[NBF]root.Data
1f16a53425
[NBF]root.Data
1f16a53426
[NBF]root.Data
1f16a53427
[NBF]root.Data
1f16a53428
[NBF]root.Data
1f16a53429
[NBF]root.Data
1f16a5343
[NBF]root.Data
1f16a53430
[NBF]root.Data
1f16a53431
[NBF]root.Data
1f16a53432
[NBF]root.Data
1f16a53433
[NBF]root.Data
1f16a53434
[NBF]root.Data
1f16a53435
[NBF]root.Data
1f16a53436
[NBF]root.Data
1f16a53437
[NBF]root.Data
1f16a5344
[NBF]root.Data
1f16a5345
[NBF]root.Data
1f16a5346
[NBF]root.Data
1f16a5347
[NBF]root.Data
1f16a5348
[NBF]root.Data
1f16a5349
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
xSm4Fg
Full Name
xSm4Fg
EntryPoint
System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
Scope Name
xSm4Fg
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xSm4Fg
Assembly Version
6.17.24.263
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void Bzp29sXqbDj.5wtWcY3_aeC::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
pop <null>
ret <null>
Module Name
xSm4Fg
Full Name
xSm4Fg
EntryPoint
System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
Scope Name
xSm4Fg
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xSm4Fg
Assembly Version
6.17.24.263
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void Bzp29sXqbDj.5wtWcY3_aeC::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void Pr7pqAe68_GgzH.Qae1pt5D/pz3Ne5D.3pwEBf4w::qDp01sk()
pop <null>
ret <null>
98b741acd352a8a48fcc8f7c94b0502e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
xSm4Fg.Resources.resources
xSm4Fg.g.resources
30866e83b6aec0.Resources.resources
1f16a5340
[NBF]root.Data
1f16a5341
[NBF]root.Data
1f16a53410
[NBF]root.Data
1f16a53411
[NBF]root.Data
1f16a53412
[NBF]root.Data
1f16a53413
[NBF]root.Data
1f16a53414
[NBF]root.Data
1f16a53415
[NBF]root.Data
1f16a53416
[NBF]root.Data
1f16a53417
[NBF]root.Data
1f16a53418
[NBF]root.Data
1f16a53419
[NBF]root.Data
1f16a5342
[NBF]root.Data
1f16a53420
[NBF]root.Data
1f16a53421
[NBF]root.Data
1f16a53422
[NBF]root.Data
1f16a53423
[NBF]root.Data
1f16a53424
[NBF]root.Data
1f16a53425
[NBF]root.Data
1f16a53426
[NBF]root.Data
1f16a53427
[NBF]root.Data
1f16a53428
[NBF]root.Data
1f16a53429
[NBF]root.Data
1f16a5343
[NBF]root.Data
1f16a53430
[NBF]root.Data
1f16a53431
[NBF]root.Data
1f16a53432
[NBF]root.Data
1f16a53433
[NBF]root.Data
1f16a53434
[NBF]root.Data
1f16a53435
[NBF]root.Data
1f16a53436
[NBF]root.Data
1f16a53437
[NBF]root.Data
1f16a5344
[NBF]root.Data
1f16a5345
[NBF]root.Data
1f16a5346
[NBF]root.Data
1f16a5347
[NBF]root.Data
1f16a5348
[NBF]root.Data
1f16a5349
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙