Suspicious
Suspect

PE Executable
MD5: c320a3e7e7f5ca8c41ff29d4679aa7ee
Size: 634.88 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 c320a3e7e7f5ca8c41ff29d4679aa7ee
Sha1 124c5d6e71394e6ea75d4e19d7334b8a66bccec3
Sha256 2d5dae8b1dedfc3530d6e029d9002235fd4faa83d9b8df3085b65d218254d00f
Sha384 f8867e3e947e487d15256dd4308fda5e0986e58bf596ea88eb62464fc2e57732755f0d16e28cf0652cdbfbbd719574da
Sha512 a6398710dce9639fae566a153484147de8a4e18b10e625fb8d1263440e1fe83f10eb4c93b621d41f76b5458161e08dff9ad23c5d8b0ec77cf09ee395cd46bd4a
SSDeep 12288:cK8mqriNZDigQ/8dhc+g5kHKgEswwMpJkSyfLZ8PjdmYZB7Gz3L9:cK8mGiJldhcd5kLEOPS9bL
TLSH EBD4E0883260B05FC9A7DB3159B0EDB4A2243DA79713C20795D71EAFB95C996CE103B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c320a3e7e7f5ca8c41ff29d4679aa7ee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Star_generator.Form1.resources
$this.Icon
[NBF]root.IconData
Moon
[NBF]root.Data
Star_generator.Properties.Resources.resources
fegm
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
YELL.exe
Full Name
YELL.exe
EntryPoint
System.Void Canada_Simulator.Program::Main()
Scope Name
YELL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YELL
Assembly Version
3.9.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
254
Main Method
System.Void Canada_Simulator.Program::Main()
Main IL Instruction Count
43
Main IL 
call System.Void Canada_Simulator.Program::‎‎‍‌‮‭‍‏‌‏‪‪‎‌​‏‭​‪‫‍‬​‍‫‮()
ldc.i4 98100039
ldc.i4 1525274254
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0096: ret
ldc.i4.0 <null>
call System.Void Canada_Simulator.Program::‍‏‎‌‫‮‌‫‮‍‏‎‪‎‫‬‏‎​‪‬‍‬​‌‪‮(System.Boolean)
ldloc.0 <null>
ldc.i4 706045890
mul <null>
ldc.i4 23867862
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Star_generator.Form1::.ctor()
call System.Void Canada_Simulator.Program::​‌‫‭‫‪‬‍‎‬‫‫‏‭‪​‍‪‭​‬‏‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 1294453513
mul <null>
ldc.i4 -872897449
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::FailSafe()
ldloc.0 <null>
ldc.i4 -849483051
mul <null>
ldc.i4 -1974974677
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::Menu()
ldloc.0 <null>
ldc.i4 2092501136
mul <null>
ldc.i4 -264914976
xor <null>
br IL_000A: ldc.i4 1525274254
ret <null>
Module Name
YELL.exe
Full Name
YELL.exe
EntryPoint
System.Void Canada_Simulator.Program::Main()
Scope Name
YELL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YELL
Assembly Version
3.9.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
254
Main Method
System.Void Canada_Simulator.Program::Main()
Main IL Instruction Count
43
Main IL 
call System.Void Canada_Simulator.Program::‎‎‍‌‮‭‍‏‌‏‪‪‎‌​‏‭​‪‫‍‬​‍‫‮()
ldc.i4 98100039
ldc.i4 1525274254
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0096: ret
ldc.i4.0 <null>
call System.Void Canada_Simulator.Program::‍‏‎‌‫‮‌‫‮‍‏‎‪‎‫‬‏‎​‪‬‍‬​‌‪‮(System.Boolean)
ldloc.0 <null>
ldc.i4 706045890
mul <null>
ldc.i4 23867862
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Star_generator.Form1::.ctor()
call System.Void Canada_Simulator.Program::​‌‫‭‫‪‬‍‎‬‫‫‏‭‪​‍‪‭​‬‏‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 1294453513
mul <null>
ldc.i4 -872897449
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::FailSafe()
ldloc.0 <null>
ldc.i4 -849483051
mul <null>
ldc.i4 -1974974677
xor <null>
br.s IL_000A: ldc.i4 1525274254
newobj System.Void Canada_Simulator.Program::.ctor()
call System.Void Canada_Simulator.Program::Menu()
ldloc.0 <null>
ldc.i4 2092501136
mul <null>
ldc.i4 -264914976
xor <null>
br IL_000A: ldc.i4 1525274254
ret <null>
c320a3e7e7f5ca8c41ff29d4679aa7ee
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Star_generator.Form1.resources
$this.Icon
[NBF]root.IconData
Moon
[NBF]root.Data
Star_generator.Properties.Resources.resources
fegm
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙