9eab119e1a445bdb9276dc76d572e20b

PE Executable

MD5: 9eab119e1a445bdb9276dc76d572e20b

Size: 670.72 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	9eab119e1a445bdb9276dc76d572e20b
Sha1	74ee9a25dc26ec7d1d14cc5d6e10f15800b6c60e
Sha256	a6eb7f69df025bf0229d9d3a9754cf687e8165978fd2fcf3accd30c6afa67562
Sha384	62d2846a6b7a1fe14617b88a77e394e7d2cd2328ab85fc93887807b51aadd216780c461275d854beaacb10707a93c1d6
Sha512	4a6bfee1ac17a77e8a9db9cda919b03c0cb96404d34b205f35dcfd9388122f65b24ec2c618fc8327fbb2362c60dbbacc918edcdd3cc706d233e36560c8989613
SSDeep	12288:dXPhh1GbcsAmL+HPzF/ynLut8qZsX9zldx3hOA0P2y3zDIeIS:hVGom+H7dynLutrZw9zbm2KD
TLSH	B2E438253B950D10E994147D867EAA00D732A0F26742B783370AF3A51E54EEDEF2E3D6

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	`System.Void dlZBlgVnVroItlAPZp.glSfuNZhHPfIloODDBCyZ::AFUHZWjRXVxqmFfwTsAffaaam(System.String[])`
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	937
Main Method	`System.Void dlZBlgVnVroItlAPZp.glSfuNZhHPfIloODDBCyZ::AFUHZWjRXVxqmFfwTsAffaaam(System.String[])`
Main IL Instruction Count	41
Main IL	ldc.r8 700 stloc V_0 br.s IL_0043: br.s IL_000F nop <null> ldloc V_0 ldc.r8 700 ceq <null> brfalse.s IL_002F: nop nop <null> ldc.r8 707 stloc V_0 nop <null> ldloc V_0 ldc.r8 707 ceq <null> brfalse.s IL_0043: br.s IL_000F br.s IL_0045: call System.Void dlZBlgVnVroItlAPZp.YLiYwAhLtwYBDbtA::SvckNWYJJMzWnoRz() br.s IL_000F: nop call System.Void dlZBlgVnVroItlAPZp.YLiYwAhLtwYBDbtA::SvckNWYJJMzWnoRz() leave.s IL_0054: nop pop <null> call System.Void dlZBlgVnVroItlAPZp.YLiYwAhLtwYBDbtA::SvckNWYJJMzWnoRz() leave.s IL_0054: nop nop <null> call System.Void dlZBlgVnVroItlAPZp.gXPEgiNdLqzKVbaRykuRENPz::DRVNaSYORifG() leave.s IL_005F: call System.Int32 rdTyRRIgBKUZSgWJVmsNSn.ytcZRNexwTAwxvsqCAm::HVGuiqZBUGgFVZorwwxDhn() pop <null> leave.s IL_005F: call System.Int32 rdTyRRIgBKUZSgWJVmsNSn.ytcZRNexwTAwxvsqCAm::HVGuiqZBUGgFVZorwwxDhn() call System.Int32 rdTyRRIgBKUZSgWJVmsNSn.ytcZRNexwTAwxvsqCAm::HVGuiqZBUGgFVZorwwxDhn() call System.Void dlZBlgVnVroItlAPZp.glSfuNZhHPfIloODDBCyZ::jULOzkLhlNLnoDxqrKKv(System.Boolean) leave.s IL_007F: ret pop <null> call System.Void uXmyWkeOmUiefJtBaToVTn.bqNMoopwwuiIabefahh::wxDgkMJUHjufXgeCJZv() leave.s IL_007F: ret nop <null> call System.Void dlZBlgVnVroItlAPZp.gXPEgiNdLqzKVbaRykuRENPz::OkcKkZAtclDRqLjVo() leave.s IL_007E: endfinally pop <null> leave.s IL_007E: endfinally endfinally <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.