Suspicious
Suspect

PE Executable
MD5: b4a768830aefa1a351f5b239ffc9f6c5
Size: 724.48 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b4a768830aefa1a351f5b239ffc9f6c5
Sha1 f8cf07f2f738fe518ff7a0595217a89e9f987e1f
Sha256 8f526c18a2151d5d43f9d3569696519bfb76a900fa8b7ff4e4f0100051730c8d
Sha384 17a3a8c9a67d1b041d4c83d3c84842214be409d9d0ff562e99304547985b6e3d946add2d48e2de9bd00b4c22c8b95e04
Sha512 2f91fca32473ff549c5de15d56fe8c60fccce43b5c7591474f912f4e86c47aac70d40536faf98e91a7710c03c0ea3b55c2006fff886e897f7248f625733145e0
SSDeep 12288:nOtj3VXlyxjS/gpKEtnMt/5OGpo5hcqOuvrhhcI:uF1icYGpoDcq7L
TLSH 44F46CE51EB43F51D17EFF354B760A7067FEB8828E22CB49354723A75A2260688C07D6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b4a768830aefa1a351f5b239ffc9f6c5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FiberaDigit.fibraship.ico
gz2FJ4jq7xnXpd.5MwxKo.resources
$this.Icon
[NBF]root.IconData
AboutDeveloperToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
AboutSoftwareToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
ExitToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
SettingsToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
gz2FJ4jq7xnXpd.Resources.resources
a0e23048198087.Resources.resources
05cdf7bb0
[NBF]root.Data
05cdf7bb1
[NBF]root.Data
05cdf7bb2
[NBF]root.Data
05cdf7bb3
[NBF]root.Data
05cdf7bb4
[NBF]root.Data
05cdf7bb5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
gz2FJ4jq7xnXpd
Full Name
gz2FJ4jq7xnXpd
EntryPoint
System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::kx5Dt()
Scope Name
gz2FJ4jq7xnXpd
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gz2FJ4jq7xnXpd
Assembly Version
8.1.20.96
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2241
Main Method
System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::kx5Dt()
Main IL Instruction Count
73
Main IL 
nop <null>
ldtoken System.Windows.Forms.Application
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.0 <null>
ldloc.0 <null>
ldstr EnableVisualStyles
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldloc.0 <null>
ldstr SetCompatibleTextRenderingDefault
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Boolean
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0071: nop
call System.Boolean gz2FJ4jq7xnXpd.Ao8f3Zgmw::da1A5wJff()
pop <null>
nop <null>
nop <null>
call System.Boolean gz2FJ4jq7xnXpd.Ao8f3Zgmw::Sin75Kemk9()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0080: nop
br.s IL_00B6: ret
nop <null>
nop <null>
call System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::ry6F0E()
nop <null>
leave.s IL_00AF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::Mm5qyfN94Hc(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
Module Name
gz2FJ4jq7xnXpd
Full Name
gz2FJ4jq7xnXpd
EntryPoint
System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::kx5Dt()
Scope Name
gz2FJ4jq7xnXpd
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gz2FJ4jq7xnXpd
Assembly Version
8.1.20.96
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2241
Main Method
System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::kx5Dt()
Main IL Instruction Count
73
Main IL 
nop <null>
ldtoken System.Windows.Forms.Application
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.0 <null>
ldloc.0 <null>
ldstr EnableVisualStyles
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldloc.0 <null>
ldstr SetCompatibleTextRenderingDefault
ldc.i4.s 24
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Boolean
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0071: nop
call System.Boolean gz2FJ4jq7xnXpd.Ao8f3Zgmw::da1A5wJff()
pop <null>
nop <null>
nop <null>
call System.Boolean gz2FJ4jq7xnXpd.Ao8f3Zgmw::Sin75Kemk9()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0080: nop
br.s IL_00B6: ret
nop <null>
nop <null>
call System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::ry6F0E()
nop <null>
leave.s IL_00AF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void gz2FJ4jq7xnXpd.Ao8f3Zgmw::Mm5qyfN94Hc(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
b4a768830aefa1a351f5b239ffc9f6c5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FiberaDigit.fibraship.ico
gz2FJ4jq7xnXpd.5MwxKo.resources
$this.Icon
[NBF]root.IconData
AboutDeveloperToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
AboutSoftwareToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
ExitToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
SettingsToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
gz2FJ4jq7xnXpd.Resources.resources
a0e23048198087.Resources.resources
05cdf7bb0
[NBF]root.Data
05cdf7bb1
[NBF]root.Data
05cdf7bb2
[NBF]root.Data
05cdf7bb3
[NBF]root.Data
05cdf7bb4
[NBF]root.Data
05cdf7bb5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙