Suspicious
Suspect

PE Executable
MD5: c3b4b99d56e31b6d1f2192a415a1c7de
Size: 1.61 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c3b4b99d56e31b6d1f2192a415a1c7de
Sha1 91f7ec07f77a08f4a68005eec41d9be71c2075bd
Sha256 3197bbcbf5856ae6299d8fa7da4c4313d75f01713739c2e49eaf716372f17edf
Sha384 a2889ed613c434c344eeaf758c464a383c91ecb739fa10103278b3716739f1bc682b5effb3d1654a5b2fc3c06fe40c6e
Sha512 527d7459b4bce9a6671c1a87605a3ccdf15b405f853825c23663490e0d28b4854a8ee51b2dae307cfef392f210acba5c333f117bfba7609658df67d7c470fc09
SSDeep 6144:NUhHgw0AifmdMo8s74iDRo5UIe0b4KT4yHH67SM4XIuioH/:MHPieX8sESuBe0iSM4vD
TLSH 6B75643CEEC83236E5B7967AC9F505CABE517843366A5C0E449B03860D53F97BE8211E
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c3b4b99d56e31b6d1f2192a415a1c7de
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
mAn4Q1kw6fRw.7nzAR9cq.resources
058642f44ce0cc.Resources.resources
15d61a510
[NBF]root.Data
15d61a511
[NBF]root.Data
15d61a512
[NBF]root.Data
15d61a513
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
mAn4Q1kw6fRw
Full Name
mAn4Q1kw6fRw
EntryPoint
System.Void mAn4Q1kw6fRw.4pyZ_7PjTj::0GnbcnB85aoR()
Scope Name
mAn4Q1kw6fRw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mAn4Q1kw6fRw
Assembly Version
29.12.15.206
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2245
Main Method
System.Void mAn4Q1kw6fRw.4pyZ_7PjTj::0GnbcnB85aoR()
Main IL Instruction Count
4
Main IL 
nop <null>
newobj System.Void mAn4Q1kw6fRw.6ccSH9xxaDs7::.ctor()
stloc.0 <null>
ret <null>
Module Name
mAn4Q1kw6fRw
Full Name
mAn4Q1kw6fRw
EntryPoint
System.Void mAn4Q1kw6fRw.4pyZ_7PjTj::0GnbcnB85aoR()
Scope Name
mAn4Q1kw6fRw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mAn4Q1kw6fRw
Assembly Version
29.12.15.206
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2245
Main Method
System.Void mAn4Q1kw6fRw.4pyZ_7PjTj::0GnbcnB85aoR()
Main IL Instruction Count
4
Main IL 
nop <null>
newobj System.Void mAn4Q1kw6fRw.6ccSH9xxaDs7::.ctor()
stloc.0 <null>
ret <null>
c3b4b99d56e31b6d1f2192a415a1c7de
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
mAn4Q1kw6fRw.7nzAR9cq.resources
058642f44ce0cc.Resources.resources
15d61a510
[NBF]root.Data
15d61a511
[NBF]root.Data
15d61a512
[NBF]root.Data
15d61a513
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙