Suspicious
Suspect

PE Executable
MD5: c3e5dc1843662f0bc5e41b16f3fa052c
Size: 67.58 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 c3e5dc1843662f0bc5e41b16f3fa052c
Sha1 9437ae17a7500f3cbc541576b7dd8b62c69073c4
Sha256 1e90b8d114e99fb4e25f93f81120e8f22c848438201bfb4ecda57ec61e09883e
Sha384 c2b7712d3598dab0b9bb7286ed183db7722722dbeb85c75fccd054f5e093d7d9de89a07ae2e74a9515d72c3b4fdb48a9
Sha512 bfebe4912462d779831cd2b30eee8d4f67febec73ea4f8eda50c51f9a5374a063ef76acc400f5d91bbdb41fdeaba61bd87c7f71c9a630304464211aaa86271f7
SSDeep 1536:rXtLE3+q3tsOjfy8qcyEAWchPfnhC+3i:rNcXy8qcyEADhxH3i
TLSH 60632B29A7ACCE2FEB9E467041721501C770D2473613EB0BDE9890B9F82378916126FB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c3e5dc1843662f0bc5e41b16f3fa052c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZetaLongPaths.Properties.Resources.resources
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rbfvefxpyl.exe
Full Name
Rbfvefxpyl.exe
EntryPoint
System.Void Igvjzbwz.Tviuey::Main()
Scope Name
Rbfvefxpyl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rbfvefxpyl
Assembly Version
1.0.3468.11254
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
134
Main Method
System.Void Igvjzbwz.Tviuey::Main()
Main IL Instruction Count
4
Main IL 
nop <null>
call System.Void Igvjzbwz.Tviuey::Ycmdzhz()
nop <null>
ret <null>
Module Name
Rbfvefxpyl.exe
Full Name
Rbfvefxpyl.exe
EntryPoint
System.Void Igvjzbwz.Tviuey::Main()
Scope Name
Rbfvefxpyl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rbfvefxpyl
Assembly Version
1.0.3468.11254
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
134
Main Method
System.Void Igvjzbwz.Tviuey::Main()
Main IL Instruction Count
4
Main IL 
nop <null>
call System.Void Igvjzbwz.Tviuey::Ycmdzhz()
nop <null>
ret <null>
c3e5dc1843662f0bc5e41b16f3fa052c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZetaLongPaths.Properties.Resources.resources
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙