Suspicious
Suspect

a474165684b2b658b8f2b8001bd2ca68

PE Executable
MD5: a474165684b2b658b8f2b8001bd2ca68
Size: 3.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 a474165684b2b658b8f2b8001bd2ca68
Sha1 179c407524508c89643473bd4b6de6242c4f75ab
Sha256 a1aab3c33644466e4c2fb71c4aaf5e475504fbf69fdcb9048f183969d6ecefe4
Sha384 94fce58cdb59ce2926a45202c1ab807022ba3d47d533d36410f7c77e4771c6828a1e97ee7ecb6b66eaddaa4cf2546be4
Sha512 688f9a378ddda2dbc358ad4631e424ce6d02ffa620700a0eb45356cca849a7220c394d1e5a5961f42e602bb7e6862832776ee9754ac1a3008bf1c83cbb01a6d8
SSDeep 49152:3vKlL26AaNeWgPhlmVqvMQ7XSK256LbRE3oGdpaTHHB72eh2NT:3vyL26AaNeWgPhlmVqkQ7XSK256Q
TLSH C6E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a474165684b2b658b8f2b8001bd2ca68
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client
Full Name
Client
EntryPoint
System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::竕㛁뙩ᮥ䙄瀲ᔟ㊖ㅬꏆҬᥐꙓ梶웨댭먓⊽艈픫(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::퍺㝰ӑ�㕫첈㊎欌뫁淹܈凎⩗뙬譅虆份ࡋ䴦(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 虒蠼ఊ￙炆㕶ວꅸ셈辽㸻가헣컨鹲�::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::竕㛁뙩ᮥ䙄瀲ᔟ㊖ㅬꏆҬᥐꙓ梶웨댭먓⊽艈픫(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 롶ꓰ隒⁐㣿儥쁽郣峙캻煍꘧�츋꥗诮䑌ո咣ퟀ::퍺㝰ӑ�㕫첈㊎欌뫁淹܈凎⩗뙬譅虆份ࡋ䴦(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 虒蠼ఊ￙炆㕶ວꅸ셈辽㸻가헣컨鹲�::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
a474165684b2b658b8f2b8001bd2ca68
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙