Suspicious
Suspect

PE Executable
MD5: 9dbeedd3ded509fd0b2058fe03cdce91
Size: 1.41 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 9dbeedd3ded509fd0b2058fe03cdce91
Sha1 c83e60eaf04e2fafcdf0960e83498dadafdd5d13
Sha256 4a9f2f65791e8bd5f4ba4cac2484577ae8eeb093fd143c1a9e9db88de7b09d7f
Sha384 ed4011cae46af3576958157aa2bfa3080bef976eab74a106512fe6545833e08b95a8bc553e1028cd738f7c209c5a2807
Sha512 90202bda9f49f1f31eb6c2288cbf7fd303fc2d938397f902a586dade029540f7c54ea345579acf4eb56c597df359a0d675d49487077c5e50dca7458c7693c9af
SSDeep 24576:HXK3GZOPLlP+E6vWPjCnRveYepqMKDmfC4KOSSn2P6EK7:HXGYoF+EiWPWRveYkqM3fC41p20
TLSH BC65E02663C15F80D1BEAB34B27810C087F0A68BD725D69F7CFC01DDAE65F891662663
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9dbeedd3ded509fd0b2058fe03cdce91
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
KatronCarecentter.dazeabnige.png
KatronCarecentter.5Zzgid.resources
PictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PictureBox3.Image
[NBF]root.Data
[NBF]root.Data.exif
[NBF]root.Data-preview.png
KatronCarecentter.Ew0ax5q.resources
KatronCarecentter.go6MQd_1bg8.resources
$this.Icon
[NBF]root.IconData
cmdSettings.Image
[NBF]root.Data
[NBF]root.Data-preview.png
edf36071172f0e.Resources.resources
9381523b0
[NBF]root.Data
9381523b1
[NBF]root.Data
9381523b10
[NBF]root.Data
9381523b11
[NBF]root.Data
9381523b12
[NBF]root.Data
9381523b13
[NBF]root.Data
9381523b14
[NBF]root.Data
9381523b15
[NBF]root.Data
9381523b16
[NBF]root.Data
9381523b17
[NBF]root.Data
9381523b18
[NBF]root.Data
9381523b19
[NBF]root.Data
9381523b2
[NBF]root.Data
9381523b20
[NBF]root.Data
9381523b21
[NBF]root.Data
9381523b22
[NBF]root.Data
9381523b23
[NBF]root.Data
9381523b24
[NBF]root.Data
9381523b25
[NBF]root.Data
9381523b26
[NBF]root.Data
9381523b27
[NBF]root.Data
9381523b28
[NBF]root.Data
9381523b29
[NBF]root.Data
9381523b3
[NBF]root.Data
9381523b30
[NBF]root.Data
9381523b31
[NBF]root.Data
9381523b32
[NBF]root.Data
9381523b33
[NBF]root.Data
9381523b34
[NBF]root.Data
9381523b35
[NBF]root.Data
9381523b36
[NBF]root.Data
9381523b37
[NBF]root.Data
9381523b38
[NBF]root.Data
9381523b39
[NBF]root.Data
9381523b4
[NBF]root.Data
9381523b40
[NBF]root.Data
9381523b41
[NBF]root.Data
9381523b5
[NBF]root.Data
9381523b6
[NBF]root.Data
9381523b7
[NBF]root.Data
9381523b8
[NBF]root.Data
9381523b9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
5moGsQs7
Full Name
5moGsQs7
EntryPoint
System.Void Kqf2sj4.Ew0ax5q::0bmMo9Wi6pkH()
Scope Name
5moGsQs7
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5moGsQs7
Assembly Version
17.15.43.236
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2510
Main Method
System.Void Kqf2sj4.Ew0ax5q::0bmMo9Wi6pkH()
Main IL Instruction Count
116
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr dazeabnige.png
stloc.1 <null>
ldloc.1 <null>
ldloca.s V_2
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_004A: ldloc.3
leave IL_0115: ret
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ldstr GetManifestResourceNames
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.String[]
stloc.s V_5
newobj System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::.ctor()
stloc.s V_7
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_6
br.s IL_009E: ldloc.s V_6
ldloc.s V_7
ldloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::Add(System.Int32,System.String)
nop <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_9
ble.s IL_0089: ldloc.s V_7
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String> System.Collections.Generic.Dictionary`2<System.Int32,System.String>::GetEnumerator()
stloc.s V_10
br.s IL_00DD: ldloca.s V_10
ldloca.s V_10
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.String> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::get_Current()
stloc.s V_11
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
ldloc.1 <null>
callvirt System.Boolean System.String::EndsWith(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00DB: nop
ldloc.3 <null>
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
nop <null>
nop <null>
nop <null>
ldloca.s V_10
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::MoveNext()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B0: ldloca.s V_10
leave.s IL_00FB: ldloc.3
ldloca.s V_10
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.3 <null>
call System.Void kXr0q7Zn.Peq5mE2p0gA::8dcDT_0o3HkgZe(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0114: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_14
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0114: nop
nop <null>
ret <null>
Module Name
5moGsQs7
Full Name
5moGsQs7
EntryPoint
System.Void Kqf2sj4.Ew0ax5q::0bmMo9Wi6pkH()
Scope Name
5moGsQs7
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5moGsQs7
Assembly Version
17.15.43.236
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2510
Main Method
System.Void Kqf2sj4.Ew0ax5q::0bmMo9Wi6pkH()
Main IL Instruction Count
116
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr dazeabnige.png
stloc.1 <null>
ldloc.1 <null>
ldloca.s V_2
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor()
stloc.3 <null>
ldloc.3 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.3 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_004A: ldloc.3
leave IL_0115: ret
ldloc.3 <null>
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ldstr GetManifestResourceNames
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.String[]
stloc.s V_5
newobj System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::.ctor()
stloc.s V_7
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_6
br.s IL_009E: ldloc.s V_6
ldloc.s V_7
ldloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.Int32,System.String>::Add(System.Int32,System.String)
nop <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_9
ble.s IL_0089: ldloc.s V_7
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String> System.Collections.Generic.Dictionary`2<System.Int32,System.String>::GetEnumerator()
stloc.s V_10
br.s IL_00DD: ldloca.s V_10
ldloca.s V_10
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.String> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::get_Current()
stloc.s V_11
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
ldloc.1 <null>
callvirt System.Boolean System.String::EndsWith(System.String)
stloc.s V_12
ldloc.s V_12
brfalse.s IL_00DB: nop
ldloc.3 <null>
ldloca.s V_11
call System.String System.Collections.Generic.KeyValuePair`2<System.Int32,System.String>::get_Value()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
nop <null>
nop <null>
nop <null>
ldloca.s V_10
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>::MoveNext()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B0: ldloca.s V_10
leave.s IL_00FB: ldloc.3
ldloca.s V_10
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.String>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.3 <null>
call System.Void kXr0q7Zn.Peq5mE2p0gA::8dcDT_0o3HkgZe(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_0114: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_14
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0114: nop
nop <null>
ret <null>
9dbeedd3ded509fd0b2058fe03cdce91
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
KatronCarecentter.dazeabnige.png
KatronCarecentter.5Zzgid.resources
PictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PictureBox3.Image
[NBF]root.Data
[NBF]root.Data.exif
[NBF]root.Data-preview.png
KatronCarecentter.Ew0ax5q.resources
KatronCarecentter.go6MQd_1bg8.resources
$this.Icon
[NBF]root.IconData
cmdSettings.Image
[NBF]root.Data
[NBF]root.Data-preview.png
edf36071172f0e.Resources.resources
9381523b0
[NBF]root.Data
9381523b1
[NBF]root.Data
9381523b10
[NBF]root.Data
9381523b11
[NBF]root.Data
9381523b12
[NBF]root.Data
9381523b13
[NBF]root.Data
9381523b14
[NBF]root.Data
9381523b15
[NBF]root.Data
9381523b16
[NBF]root.Data
9381523b17
[NBF]root.Data
9381523b18
[NBF]root.Data
9381523b19
[NBF]root.Data
9381523b2
[NBF]root.Data
9381523b20
[NBF]root.Data
9381523b21
[NBF]root.Data
9381523b22
[NBF]root.Data
9381523b23
[NBF]root.Data
9381523b24
[NBF]root.Data
9381523b25
[NBF]root.Data
9381523b26
[NBF]root.Data
9381523b27
[NBF]root.Data
9381523b28
[NBF]root.Data
9381523b29
[NBF]root.Data
9381523b3
[NBF]root.Data
9381523b30
[NBF]root.Data
9381523b31
[NBF]root.Data
9381523b32
[NBF]root.Data
9381523b33
[NBF]root.Data
9381523b34
[NBF]root.Data
9381523b35
[NBF]root.Data
9381523b36
[NBF]root.Data
9381523b37
[NBF]root.Data
9381523b38
[NBF]root.Data
9381523b39
[NBF]root.Data
9381523b4
[NBF]root.Data
9381523b40
[NBF]root.Data
9381523b41
[NBF]root.Data
9381523b5
[NBF]root.Data
9381523b6
[NBF]root.Data
9381523b7
[NBF]root.Data
9381523b8
[NBF]root.Data
9381523b9
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙