Deep Malware Analysis of b786ff3c4040974c544156d8e5bbbcf0 | md5: b786ff3c4040974c544156d8e5bbbcf0 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.22

PE Executable

MD5: b786ff3c4040974c544156d8e5bbbcf0

Size: 644.1 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	b786ff3c4040974c544156d8e5bbbcf0
Sha1	dacfc30299935dd3f3827d3e98524fa1195d50f7
Sha256	35c8388a3b8fb7c09ee5786f1bdcfef5a30f04563624dce11d8a2b943bf3a614
Sha384	d876381851665142d89191458cb1d305529958622da7f2ac7029cc87c2d404ddbe85bf31db014cc87f4186688c186c5e
Sha512	8003afa6c2c39a807dea3e805071d5a8155d6610c80f1cd318ceb0b800f069dd7a844306c4f46d6c4e350d97b3768431baccb75c0e62c325b25a52a23b2023af
SSDeep	12288:DbHfLPHe//qaIa2oNUkWGerRDj4pxRSCTInZHxTgdAA:DLfjHe//qaB3Y/t4pHS1px2A
TLSH	00D4ADE06744C422D8A79AB88836D7B36533AE4DEC29860D2DD5FF5B3D73342102799B

Name	Value
Module Name	NZgU.exe
Full Name	NZgU.exe
EntryPoint	System.Void DemoSaver.Program::Main(System.String[])
Scope Name	NZgU.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NZgU
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	111
Main Method	System.Void DemoSaver.Program::Main(System.String[])
Main IL Instruction Count	45
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void Game15.Game15::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldarg.0 <null> call DemoSaver.Program/ScreenSaverArgs DemoSaver.Program::ParseSaverArgs(System.String[]) stloc.0 <null> newobj System.Void DemoSaver.ScreenSaverVisualizer::.ctor() stloc.1 <null> ldloc.1 <null> newobj System.Void DemoSaver.ScreenSaverWindow::.ctor(DemoSaver.IScreenSaverVisualizer) stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> ldloc.0 <null> ldfld DemoSaver.Program/ScreenSaverStates DemoSaver.Program/ScreenSaverArgs::SaverMode stloc.s V_4 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> br.s IL_0082: ldloc.3 ldc.i4.1 <null> stloc.3 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr) brfalse.s IL_0082: ldloc.3 ldloc.2 <null> ldloc.0 <null> ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle callvirt System.Void DemoSaver.ScreenSaverWindow::SetSaverPreviewMode(System.IntPtr) br.s IL_0082: ldloc.3 ldstr No configuration available. ldstr Test Saver call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldloc.3 <null> brfalse.s IL_008B: ret ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

NZhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

NZhuhuhuhu

b786ff3c4040974c544156d8e5bbbcf0

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.