Suspicious
Suspect

PE Executable
MD5: c5003c1bd68198ba902badeabbb534b1
Size: 890.37 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 c5003c1bd68198ba902badeabbb534b1
Sha1 729414c8caa659d01f2c575b50b0aeac021eccf3
Sha256 5c14649f341b72c153a02cc99d0852f7b0ded81f67a6513af7d188dfdce5a53e
Sha384 a1721e5912ff8f7f47c79935ae426e33452f1bcd9731e9a9a4f209cb27571461f2ee59c04dba992f070d7a1a5c8d8245
Sha512 a4fcc53ba59ba2cb2c4f9defd22891ce1aea528bcd68fd18093ee43fe2da899f2616d69592a796b830ade2bf87ae68611fa21c567a1b11852315f7cc24155b25
SSDeep 24576:j6DRQUW7rs4kr6X0Rqolg2YbYkZ8Hh5hzCZBSF:02vlkrq0Rqruk2H9CGF
TLSH 2D15CFAC3210B99FC453CE729A70DD70AA207DAA9707C20395D71D9FB91DA96DF102F2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c5003c1bd68198ba902badeabbb534b1
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
TzBh
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
rSld.exe
Full Name
rSld.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
rSld.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rSld
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
57
Main IL 
nop <null>
call System.Void EventLogAnalyzer.Program::‭‌‎‬‍‮‎‪‌‭‫‬‫‍‭‏‭‎‪‫‌‌‍‮‭‌‮()
nop <null>
ldc.i4 -1682551218
ldc.i4 -1027350417
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003E: nop
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‫‫‍‮‭‏‫‫‭​‭‭‪‮‏‪‌‮‬‏‍‬‏‍‌‪‬‮(System.Boolean)
ldloc.1 <null>
ldc.i4 1373339308
mul <null>
ldc.i4 -1079162713
xor <null>
br.s IL_000C: ldc.i4 -1027350417
nop <null>
nop <null>
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‭‏‮‎‍‎‬‍‏‎‪‪‌‪‎‫‭‭‌‏‌​‍‬‮(System.Windows.Forms.Form)
nop <null>
ldc.i4 -1723000312
ldc.i4 -1027350417
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_007D: leave.s IL_00A7
nop <null>
ldloc.1 <null>
ldc.i4 -1679867718
mul <null>
ldc.i4 2035203287
xor <null>
br.s IL_0050: ldc.i4 -1027350417
leave.s IL_00A7: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‪‮‭‮​‮‎‬​‍‎‎‪‫‎‮‍‌​‏‍‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‍‫‏‭‌‮‪‌‪‬‪‭‫‏‭‍‏​‪‎‭‏‎‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‌‬‫‭​‪‪‭‬‏‎‌‭‌‫‏‪‌‬‏‪‫‍‏‍‌‫‬‍‪‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_00A7: ret
ret <null>
Module Name
rSld.exe
Full Name
rSld.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
rSld.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rSld
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
57
Main IL 
nop <null>
call System.Void EventLogAnalyzer.Program::‭‌‎‬‍‮‎‪‌‭‫‬‫‍‭‏‭‎‪‫‌‌‍‮‭‌‮()
nop <null>
ldc.i4 -1682551218
ldc.i4 -1027350417
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_003E: nop
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‫‫‍‮‭‏‫‫‭​‭‭‪‮‏‪‌‮‬‏‍‬‏‍‌‪‬‮(System.Boolean)
ldloc.1 <null>
ldc.i4 1373339308
mul <null>
ldc.i4 -1079162713
xor <null>
br.s IL_000C: ldc.i4 -1027350417
nop <null>
nop <null>
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‎‭‏‮‎‍‎‬‍‏‎‪‪‌‪‎‫‭‭‌‏‌​‍‬‮(System.Windows.Forms.Form)
nop <null>
ldc.i4 -1723000312
ldc.i4 -1027350417
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_007D: leave.s IL_00A7
nop <null>
ldloc.1 <null>
ldc.i4 -1679867718
mul <null>
ldc.i4 2035203287
xor <null>
br.s IL_0050: ldc.i4 -1027350417
leave.s IL_00A7: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‪‮‭‮​‮‎‬​‍‎‎‪‫‎‮‍‌​‏‍‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‍‫‏‭‌‮‪‌‪‬‪‭‫‏‭‍‏​‪‎‭‏‎‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‌‬‫‭​‪‪‭‬‏‎‌‭‌‫‏‪‌‬‏‪‫‍‏‍‌‫‬‍‪‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_00A7: ret
ret <null>
c5003c1bd68198ba902badeabbb534b1
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
IO
[NBF]root.Data
TzBh
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙