Suspicious
Suspect

a3cacd28539bc57b5d5f58c031e7fcae

PE Executable
MD5: a3cacd28539bc57b5d5f58c031e7fcae
Size: 1.24 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.24 MB · 1,242,624 B
Hashes
MD5 a3cacd28539bc57b5d5f58c031e7fcae Sha1 c71435b114a28062c7f8822daa44d1e5c7cb17aa Sha256 5a687df0307fcc7b5b66d2d2f1fe271e8db390df9366b30c4502f5ff7076e833 Sha384 369267f1f34ec4f504fb4573fb9b1707d0db11f582fcc04030f91d9eab82379ee7e43b8096cfe11e1e3e3b8463308009 Sha512 8acfc3c2e78f5d127d8728d95fa8bb6621eb982e925c8aca9ddfeb79a00067e6c71c82683b7abe62b67ba6a7ff10004c723b7a11108ec52f8c9ec07fd892d933 SSDeep 24576:f6cUAtPa6ObJ+SAmkqkX7JhQzi5IO7kL44+wEm:JXPalESAmynQzmHkL3w TLSH 4745F12112D99F59F5BF97748875504887F3BC469F31D7EE3E4C1CEA3A22A808A61723
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Very high
57 files
EXEa3cacd28539bc57b5d5f58c031e7fcae
Structure
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINMs6io0oRWsn2w3.g.resources
BINMs6io0oRWsn2w3.Resources.resources
BIN57242a68270560.Resources.resources
BINe97e54ee0
DATA[NBF]root.Data
BINe97e54ee1
DATA[NBF]root.Data
BINe97e54ee10
DATA[NBF]root.Data
BINe97e54ee11
DATA[NBF]root.Data
BINe97e54ee12
DATA[NBF]root.Data
BINe97e54ee13
DATA[NBF]root.Data
BINe97e54ee14
DATA[NBF]root.Data
BINe97e54ee15
DATA[NBF]root.Data
BINe97e54ee16
DATA[NBF]root.Data
BINe97e54ee17
DATA[NBF]root.Data
BINe97e54ee18
DATA[NBF]root.Data
BINe97e54ee19
DATA[NBF]root.Data
BINe97e54ee2
DATA[NBF]root.Data
BINe97e54ee20
DATA[NBF]root.Data
BINe97e54ee21
DATA[NBF]root.Data
BINe97e54ee22
DATA[NBF]root.Data
BINe97e54ee23
DATA[NBF]root.Data
BINe97e54ee24
DATA[NBF]root.Data
BINe97e54ee3
DATA[NBF]root.Data
BINe97e54ee4
DATA[NBF]root.Data
BINe97e54ee5
DATA[NBF]root.Data
BINe97e54ee6
DATA[NBF]root.Data
BINe97e54ee7
DATA[NBF]root.Data
BINe97e54ee8
DATA[NBF]root.Data
BINe97e54ee9
DATA[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ms6io0oRWsn2w3
Full Name
Ms6io0oRWsn2w3
EntryPoint
System.Void Ms6io0oRWsn2w3.Rjn53mEt::if3ZyMe()
Scope Name
Ms6io0oRWsn2w3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ms6io0oRWsn2w3
Assembly Version
15.27.40.61
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
785
Main Method
System.Void Ms6io0oRWsn2w3.Rjn53mEt::if3ZyMe()
Main IL Instruction Count
85
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Capnogramat
call System.Boolean Ms6io0oRWsn2w3.Rjn53mEt/tZc4K8rriL0.Co6ynBw8s::Bjj3sN(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0020: ldc.r8 25
leave IL_00D4: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldstr /
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 892436.pcx
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] Ms6io0oRWsn2w3.Ek9sm4fNQf3ae::Ft2wcHk6w(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_008C: ldloc.s V_5
leave.s IL_00D4: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] Ms6io0oRWsn2w3.1Zdqg9gNdL0j/0wjRf6PcZkq75e.Rz8sn2pL::qQw0G_4dfgF96(System.Byte[])
stelem.ref <null>
ldstr L o a d
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ms6io0oRWsn2w3.Rjn53mEt/mk4WJ5pm.7SbyarT0X2zi3x::1Ngbf9jA2WmfPt(System.String,System.Object)
pop <null>
leave.s IL_00D3: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D3: nop
nop <null>
ret <null>
Module Name
Ms6io0oRWsn2w3
Full Name
Ms6io0oRWsn2w3
EntryPoint
System.Void Ms6io0oRWsn2w3.Rjn53mEt::if3ZyMe()
Scope Name
Ms6io0oRWsn2w3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ms6io0oRWsn2w3
Assembly Version
15.27.40.61
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
785
Main Method
System.Void Ms6io0oRWsn2w3.Rjn53mEt::if3ZyMe()
Main IL Instruction Count
85
Main IL 
nop <null>
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldstr Capnogramat
call System.Boolean Ms6io0oRWsn2w3.Rjn53mEt/tZc4K8rriL0.Co6ynBw8s::Bjj3sN(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0020: ldc.r8 25
leave IL_00D4: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldstr /
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr 892436.pcx
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] Ms6io0oRWsn2w3.Ek9sm4fNQf3ae::Ft2wcHk6w(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_008C: ldloc.s V_5
leave.s IL_00D4: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] Ms6io0oRWsn2w3.1Zdqg9gNdL0j/0wjRf6PcZkq75e.Rz8sn2pL::qQw0G_4dfgF96(System.Byte[])
stelem.ref <null>
ldstr L o a d
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ms6io0oRWsn2w3.Rjn53mEt/mk4WJ5pm.7SbyarT0X2zi3x::1Ngbf9jA2WmfPt(System.String,System.Object)
pop <null>
leave.s IL_00D3: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D3: nop
nop <null>
ret <null>
57 files
EXEa3cacd28539bc57b5d5f58c031e7fcae
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙