Suspicious
Suspect

b2ab924d146eafae88ef5726d5899123

PE Executable
MD5: b2ab924d146eafae88ef5726d5899123
Size: 731.14 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b2ab924d146eafae88ef5726d5899123
Sha1 798cbe4ff1cdfd502a4788b7e4ead143a5372712
Sha256 c87c4280f8b9c6bf09c0ac878f0f5d0b1ffaf1cf0627acecd0585e79f5d4b2eb
Sha384 3ce2b8721d04a67e893d137102de4055de1f20632d6db6c5e5990e7dd689b9d18eaea929d7a0b45a32194d63bd995dfc
Sha512 93e4287f62630c8c3b252b2de4678e667bb38ca9afc5f627ea2e6bb2f64c180265b3b7e934776af19c7487007f4496db24d32438aee014d80fd854cb95a00e57
SSDeep 12288:tWZ0Lpr9YtQZZzdCJvkx4uDsBVzlaDSNd7GPbv1b9iTQgm2Cagwz+0fSpCd/C/V:5dZZzdCJvkYzllNkPbdb9tV2Cv+Kz
TLSH CAF4AD2423EC5A08F5BF2B39697415140BF1FC26DA32DA1E6E9690DE0EA5F80DD61733
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b2ab924d146eafae88ef5726d5899123
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
in0LN6sq.g.resources
in0LN6sq.Resources.resources
cf5b165a996369.Resources.resources
c70b8f6a0
[NBF]root.Data
c70b8f6a1
[NBF]root.Data
c70b8f6a2
[NBF]root.Data
c70b8f6a3
[NBF]root.Data
c70b8f6a4
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
in0LN6sq
Full Name
in0LN6sq
EntryPoint
System.Void in0LN6sq.8abRyQp/8bqMTz1tceR.Zpp7k6SfJq8ra3::Tis0a2()
Scope Name
in0LN6sq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
in0LN6sq
Assembly Version
3.29.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void in0LN6sq.8abRyQp/8bqMTz1tceR.Zpp7k6SfJq8ra3::Tis0a2()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void in0LN6sq.yw1Ps9Qqsd5FJ4::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
Module Name
in0LN6sq
Full Name
in0LN6sq
EntryPoint
System.Void in0LN6sq.8abRyQp/8bqMTz1tceR.Zpp7k6SfJq8ra3::Tis0a2()
Scope Name
in0LN6sq
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
in0LN6sq
Assembly Version
3.29.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void in0LN6sq.8abRyQp/8bqMTz1tceR.Zpp7k6SfJq8ra3::Tis0a2()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void in0LN6sq.yw1Ps9Qqsd5FJ4::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
b2ab924d146eafae88ef5726d5899123
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
in0LN6sq.g.resources
in0LN6sq.Resources.resources
cf5b165a996369.Resources.resources
c70b8f6a0
[NBF]root.Data
c70b8f6a1
[NBF]root.Data
c70b8f6a2
[NBF]root.Data
c70b8f6a3
[NBF]root.Data
c70b8f6a4
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙