Malicious
Malicious

9e89b3a9bca360ebf229b43715ed693e

Share on LinkedIn
Print
PE Executable
MD5: 9e89b3a9bca360ebf229b43715ed693e
Size: 1.68 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 9e89b3a9bca360ebf229b43715ed693e
Sha1 421fd6c4c3f0c35b543b759f301980808bfddad2
Sha256 d623ebd387e46bf8cb0f970d6238d95e5e3226ffce22a987e9565e65753ac603
Sha384 18791bcfe3640333e5c052a71b23e4adcaa14c300adea1ef2d76233efe9eac64607d11ccda1c0be5bf78b2678604af0d
Sha512 b8f16240d9d04797356a24834096bbfc38cdf0316a46d795a6a3046f6fea2c678a1bcfba9890a3771be9129904c93928973c11e7a1ee9462783edd01fa2847fa
SSDeep 24576:hg+o7K5G92x95MER+A3EDs8H3dIRaAL00z4pIsBaZA1h/ZpTEgJL2Q5eD0YL6oUT:hg+oX9MogydYaAvNYaZA1tZp7L2d8V
TLSH 96759D017E45CE11F0091A33C3EF858847B49951AAA6E71B7DBA377E65123A73C0DACB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9e89b3a9bca360ebf229b43715ed693e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:1033
.Net Resources
EIfiHnusBQuWxYFQmV.l1dN93FIZ1NBpWi1GI
GcHir6NjBi4UhlP2de.PnuriRZLGMdKkQGVAU
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
Full Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
EntryPoint
System.Void siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::WbrG4tue86()
Scope Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XqPZAR87ZnQ0ZquhDQu1EJKhbBIIDxx39
Assembly Version
9.9.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::WbrG4tue86()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void wM5VdQGeQggsEKSRqCC.FgUVgvGmrhXiWqB6j2Q::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::tgOGPhjT5b
callvirt System.Void Op9W6XqmG9JfHZAafhi.fxqxXfqVyFZEDHK9MFZ::b4lLNo81dS()
nop <null>
ret <null>
Module Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
Full Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
EntryPoint
System.Void siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::WbrG4tue86()
Scope Name
GDUJOtXlrLb23LydxqTQSDwjSKjMEPKTtzXBkx
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XqPZAR87ZnQ0ZquhDQu1EJKhbBIIDxx39
Assembly Version
9.9.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::WbrG4tue86()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void wM5VdQGeQggsEKSRqCC.FgUVgvGmrhXiWqB6j2Q::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object siS8RrqUbFNLT6VKoib.VQV3OiqA0dQAM7xJiM7::tgOGPhjT5b
callvirt System.Void Op9W6XqmG9JfHZAafhi.fxqxXfqVyFZEDHK9MFZ::b4lLNo81dS()
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙