Deep Malware Analysis of a72fbedc6515423321246d11c82db58e | md5: a72fbedc6515423321246d11c82db58e | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.83

PE Executable

MD5: a72fbedc6515423321246d11c82db58e

Size: 811.52 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	a72fbedc6515423321246d11c82db58e
Sha1	784867a6c3a76e1947919914e166411208fd1e4d
Sha256	8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a
Sha384	4e88048a444456eece99288a0bfdcd381e2f952ddfc668a55d31e975468135c1389337344d047e2b7031cdacb9dd40cc
Sha512	acae085913577b13eee8bec210f167a7ba4002cb59911fa8ee2e3937597f6dd300ec53932b29504e9046d9a88b64f49cfe7a86a784ec55213fd1022aa3141931
SSDeep	12288:MXTOwBxSGxz9MVl8d0lGEskv+7MeLYLNB9HcsUEgZn0g2cpL5/XUJm5Kzhan23nw:MxBEGxml8mlX+sL79Hn2Zp269kE4
TLSH	1505CFAC3200B99FC457D9728DA4EC74AA646CAA930BD20395D31DEFBD0D696CF141E3

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	JIfN.exe
Full Name	JIfN.exe
EntryPoint	System.Void UnitConverter.Program::Main()
Scope Name	JIfN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JIfN
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void UnitConverter.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> ldc.i4 96916837 ldc.i4 987737108 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0052: newobj System.Void UnitConverter.Forms.MainForm::.ctor() call System.Void UnitConverter.Program::⁪⁫⁬⁭‎‏⁭⁮‌‏‍⁯‏⁮‮⁫⁭‌‮‮⁮‮⁮⁯‌⁬‏‮⁫⁮‭‎‬‌‏⁯‮() nop <null> ldc.i4.0 <null> call System.Void UnitConverter.Program::‭‬⁪‭⁪⁪⁮⁯⁪⁮‎‭⁭⁬⁫‮‏⁯‎⁭⁮‬⁬‮⁪⁭‪⁯⁪⁭‎⁫⁭‮(System.Boolean) ldloc.0 <null> ldc.i4 -1525343634 mul <null> ldc.i4 996271201 xor <null> br.s IL_0006: ldc.i4 987737108 nop <null> ldloc.0 <null> ldc.i4 -848775277 mul <null> ldc.i4 -1587024031 xor <null> br.s IL_0006: ldc.i4 987737108 newobj System.Void UnitConverter.Forms.MainForm::.ctor() call System.Void UnitConverter.Program::⁬⁮‏‬‫⁮⁫⁭‪‏‪⁬⁪‪‌‎‬‬‌⁭⁬‍‎‪⁮‏‍‌‎‍‍‬‬‌‮‫⁬‎‮(System.Windows.Forms.Form) nop <null> ret <null>
Module Name	JIfN.exe
Full Name	JIfN.exe
EntryPoint	System.Void UnitConverter.Program::Main()
Scope Name	JIfN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JIfN
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void UnitConverter.Program::Main()
Main IL Instruction Count	31
Main IL	nop <null> ldc.i4 96916837 ldc.i4 987737108 xor <null> dup <null> stloc.0 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0052: newobj System.Void UnitConverter.Forms.MainForm::.ctor() call System.Void UnitConverter.Program::⁪⁫⁬⁭‎‏⁭⁮‌‏‍⁯‏⁮‮⁫⁭‌‮‮⁮‮⁮⁯‌⁬‏‮⁫⁮‭‎‬‌‏⁯‮() nop <null> ldc.i4.0 <null> call System.Void UnitConverter.Program::‭‬⁪‭⁪⁪⁮⁯⁪⁮‎‭⁭⁬⁫‮‏⁯‎⁭⁮‬⁬‮⁪⁭‪⁯⁪⁭‎⁫⁭‮(System.Boolean) ldloc.0 <null> ldc.i4 -1525343634 mul <null> ldc.i4 996271201 xor <null> br.s IL_0006: ldc.i4 987737108 nop <null> ldloc.0 <null> ldc.i4 -848775277 mul <null> ldc.i4 -1587024031 xor <null> br.s IL_0006: ldc.i4 987737108 newobj System.Void UnitConverter.Forms.MainForm::.ctor() call System.Void UnitConverter.Program::⁬⁮‏‬‫⁮⁫⁭‪‏‪⁬⁪‪‌‎‬‬‌⁭⁬‍‎‪⁮‏‍‌‎‍‍‬‬‌‮‫⁬‎‮(System.Windows.Forms.Form) nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.