c4665a57bcddbc93ffe923e7b28b8426

PE Executable

MD5: c4665a57bcddbc93ffe923e7b28b8426

Size: 94.72 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	c4665a57bcddbc93ffe923e7b28b8426
Sha1	3e14d05d7c35ae88e9676e54b20a3cb1b971f9c7
Sha256	f8ebd0c602fc643f55fb11d586832a1209b72163a5ad881ff9dbcdc613b03bf0
Sha384	0750d9b905d0a3ed0f4e17601ea3d60731db6f33f0a647560452b285bed1887b23243b28cf5524f19363e4d63c7280a9
Sha512	78a66a8ac5fa7617c5bafcd3bd90df949d06077601b887e1e136a7a723d1caead84457f387cada13eb934a0ee6f4d448dd97be86cea28830e8e08ce0c94768fe
SSDeep	1536:kZ531+va3dxksfxrIODdaH16+i0s2dDuSb3+5tkrjNMyAY5kX6I7fZUc46zF:m53EvugyrIODdaH1igdDuN5Sr5Tf277d
TLSH	6F93E115B299C17BCCBF1BF89CB2220047725AC6E63ED78E3E84648D296279045D0FB7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

img 2bin 1

Name	Value
Module Name	ghLauncher.exe
Full Name	ghLauncher.exe
EntryPoint	System.Void GhLauncher.Program::Main()
Scope Name	ghLauncher.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ghLauncher
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	80
Main Method	System.Void GhLauncher.Program::Main()
Main IL Instruction Count	10
Main IL	ldc.i4 3264 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.8 <null> call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void GhLauncher.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	ghLauncher.exe
Full Name	ghLauncher.exe
EntryPoint	System.Void GhLauncher.Program::Main()
Scope Name	ghLauncher.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ghLauncher
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	80
Main Method	System.Void GhLauncher.Program::Main()
Main IL Instruction Count	10
Main IL	ldc.i4 3264 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.8 <null> call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void GhLauncher.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.