Malicious
Malicious

PE Executable
MD5: bc1e49bcba9492e3b0e039149541e5c9
Size: 980.99 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 bc1e49bcba9492e3b0e039149541e5c9
Sha1 f1a34cdc9a5d38fc858ef5a8502bc79a413edc75
Sha256 84ae2d417293f0b4719b09b0fc7d090cf5c3349c6f61a2a82fe49698d8f7f88b
Sha384 ec2a47523b56eee612c159c2f6eed24063531063cadbfd702359e2c37be46403bd473a84f03236e899bcfbc39e546d6c
Sha512 7876a8ed9a37adc81636e6c55effb2a76c666ab4894ecb3569e58fe72b613bdacbeec9f7d0d5e9f37d36a42d7deabe1d219d6b4fe988e439406123bfc7445d03
SSDeep 12288:mvuvwwhNcZyl06eHIxY91mNZbzZQ3K7zHtxawLoFEyoEnH23H60:aeFhNVl06eHIxLVvNxawMGkH23l
TLSH B92518017E44CA21F1095633C2EF894887B8995166E6E32B7DBB376E19523E73C0D9CB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
blockAgent.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
BLfjm7sODxAmx1D386.dNRUEikpvuIUdcWkmg
qLAaaFPoqKm2yX9J0g.13HjjQ1ounDXHIM1uR
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
Full Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
EntryPoint
System.Void yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::LVora1DnWr()
Scope Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vNjGFH4DcwUi37rYSBSLOMoLV0StihJVp
Assembly Version
3.0.4.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::LVora1DnWr()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void qjNh4UsGV0kW7FBkF9n.ijJ7Y5siAF1lPaiVFwC::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::y22rxfTTvh
callvirt System.Void j6mEEjJisv1V2G0vVdE.BZWUHeJ0VfRWUDnXRPM::FCk5TRMArU()
nop <null>
ret <null>
Module Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
Full Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
EntryPoint
System.Void yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::LVora1DnWr()
Scope Name
4l5tYXjiUOajWuYt7kbAMjCCvq8QhBCMXriC3o13cDOX
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vNjGFH4DcwUi37rYSBSLOMoLV0StihJVp
Assembly Version
3.0.4.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::LVora1DnWr()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void qjNh4UsGV0kW7FBkF9n.ijJ7Y5siAF1lPaiVFwC::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object yLkZ5vJb22nQlIR5fFT.FxTm9qJv8TWnIWMQTEQ::y22rxfTTvh
callvirt System.Void j6mEEjJisv1V2G0vVdE.BZWUHeJ0VfRWUDnXRPM::FCk5TRMArU()
nop <null>
ret <null>
blockAgent.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
BLfjm7sODxAmx1D386.dNRUEikpvuIUdcWkmg
qLAaaFPoqKm2yX9J0g.13HjjQ1ounDXHIM1uR
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙