Suspicious
Suspect

c05883a0cd30f17bbbb849af850e2e33

PE Executable
MD5: c05883a0cd30f17bbbb849af850e2e33
Size: 6.16 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 c05883a0cd30f17bbbb849af850e2e33
Sha1 167e8329f70b8c740b113cc205f238fe89ceb1dd
Sha256 e7a8b3df8b07fb6b0262ad835e0c42933339067bf450edd3f4bfae9d3d9fd42a
Sha384 5891ac99f517808363051e86bb82e7300b5479d0d5e7d94960534055163c0caccc65e48efe6845f10b6d5e749358d651
Sha512 8a3f80bde36f56d2ad461606e4e770d433dc2d4c22923de0cb1d971c1f84821c352e3f543c22c978c7d2bcc877910bd65139384a53b8acb4707b31dac7210c42
SSDeep 49152:mhz4RwKlFrBvopny8pu8i8zbi5/V1OhJ4uPZ2KtwCJZ0TjzUPD2iFGLyedRZczVV:mR4RLFrBvopny8EGhJFMGGLymsc
TLSH 17569D04BBF85E2AD07FC675D4B14012A3F0F85EB323DB9F1A8196792E23B809915767
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
c05883a0cd30f17bbbb849af850e2e33
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Prisma.Common.WalletCrack.bip39-english.txt
H264SharpNative-win64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
openh264-2.4.1-win64.dll
[Authenticode]_33633641.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rodata
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Prisma.Client.Properties.Resources.resources
NAudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.WinMM.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
HvncHook32.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.reloc
HvncHook64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
HvncInject64.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
ILRepack.List
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 6 STICH kept: 2secondary ignored: 4
bin 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Path pe:exe>pe:exe
Shape pe:exe>pe:exe
2 nodes
Name Value
Module Name
client
Full Name
client
EntryPoint
System.Void Prisma.Client.Program::Main(System.String[])
Scope Name
client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Info
PE Detect: PeReader OK (file layout)
Total Strings
15864
Main Method
System.Void Prisma.Client.Program::Main(System.String[])
Main IL Instruction Count
71
Main IL 
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0042: ldloca.s V_0
call System.Boolean Prisma.Client.Program::AllocConsole()
pop <null>
ldstr Prisma Debug Terminal
call System.Boolean Prisma.Client.Program::SetConsoleTitle(System.String)
pop <null>
ldc.i4.s 10
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr === PRISMA DEBUG TERMINAL ===
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldstr Process started: 
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.String::Concat(System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldloca.s V_0
call System.Boolean Prisma.Client.Program::IsRestartLooping(System.String&)
brfalse.s IL_0084: ldc.i4 3072
ldstr BLOCKED: restart loop detected — 
ldloc.0 <null>
ldstr . Exiting.
call System.String System.String::Concat(System.String,System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0083: ret
ldc.i4.s 12
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr Press any key to close...
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_00C4: ldc.i4.2
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadExceptionDebug(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledExceptionDebug(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
br.s IL_00F1: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadException(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldstr Starting PrismaApplication...
call System.Void Prisma.Client.Program::DbgLog(System.String)
newobj System.Void Prisma.Client.PrismaApplication::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldstr PrismaApplication exited.
call System.Void Prisma.Client.Program::DbgLog(System.String)
ret <null>
Module Name
client
Full Name
client
EntryPoint
System.Void Prisma.Client.Program::Main(System.String[])
Scope Name
client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
15864
Main Method
System.Void Prisma.Client.Program::Main(System.String[])
Main IL Instruction Count
71
Main IL 
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0042: ldloca.s V_0
call System.Boolean Prisma.Client.Program::AllocConsole()
pop <null>
ldstr Prisma Debug Terminal
call System.Boolean Prisma.Client.Program::SetConsoleTitle(System.String)
pop <null>
ldc.i4.s 10
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr === PRISMA DEBUG TERMINAL ===
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldstr Process started: 
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.String::Concat(System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldloca.s V_0
call System.Boolean Prisma.Client.Program::IsRestartLooping(System.String&)
brfalse.s IL_0084: ldc.i4 3072
ldstr BLOCKED: restart loop detected — 
ldloc.0 <null>
ldstr . Exiting.
call System.String System.String::Concat(System.String,System.String,System.String)
call System.Void Prisma.Client.Program::DbgLog(System.String)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_0083: ret
ldc.i4.s 12
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr Press any key to close...
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldsfld System.Boolean Prisma.Client.Config.Settings::DEBUG_CONSOLE
brfalse.s IL_00C4: ldc.i4.2
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadExceptionDebug(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledExceptionDebug(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
br.s IL_00F1: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleThreadException(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Prisma.Client.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldstr Starting PrismaApplication...
call System.Void Prisma.Client.Program::DbgLog(System.String)
newobj System.Void Prisma.Client.PrismaApplication::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldstr PrismaApplication exited.
call System.Void Prisma.Client.Program::DbgLog(System.String)
ret <null>
c05883a0cd30f17bbbb849af850e2e33
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Prisma.Common.WalletCrack.bip39-english.txt
H264SharpNative-win64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.tls
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
openh264-2.4.1-win64.dll
[Authenticode]_33633641.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rodata
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
Prisma.Client.Properties.Resources.resources
NAudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.WinMM.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
NAudio.Wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
HvncHook32.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.reloc
HvncHook64.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
HvncInject64.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙