Suspicious
Suspect

c981b8144e2aebd6080858b04af3b600

PE Executable
MD5: c981b8144e2aebd6080858b04af3b600
Size: 939.52 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c981b8144e2aebd6080858b04af3b600
Sha1 4840c94508f6f9ebbd7389aa7e53a3436bb0d0c0
Sha256 dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042
Sha384 6a747eef76fa0f01aeda9e275d725b737d19ff836d846b4db7bc456f69c3c4c3f78bae72c9b2e31a32c149b4c24fb17c
Sha512 f02101668c362ac241fa7285aba9c73ee46404ce47ec802819090fb61e9124e237c0af32c8e5da0217742ce4bbd9ed6396cc587220ee1ae39f1dd693f052777d
SSDeep 12288:W1kJXxY9bXvXAdpr+8Esd4sEwRA8DX2YI1Qsc6F3lrK/CDS:0exAIdZ+8EsdfRA8DXsjF3le
TLSH B815E0615EA726B5E89C0B78C023089C33F4E4071166DB6F0FED84F5AFAAF96D917850
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c981b8144e2aebd6080858b04af3b600
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ⴓ.ai1Z0tF.resources
0Lzgk1Mr.g.resources
c363278114c850.Resources.resources
0e6d358a0
[NBF]root.Data
0e6d358a1
[NBF]root.Data
0e6d358a10
[NBF]root.Data
0e6d358a11
[NBF]root.Data
0e6d358a12
[NBF]root.Data
0e6d358a13
[NBF]root.Data
0e6d358a14
[NBF]root.Data
0e6d358a15
[NBF]root.Data
0e6d358a16
[NBF]root.Data
0e6d358a17
[NBF]root.Data
0e6d358a18
[NBF]root.Data
0e6d358a19
[NBF]root.Data
0e6d358a2
[NBF]root.Data
0e6d358a20
[NBF]root.Data
0e6d358a21
[NBF]root.Data
0e6d358a22
[NBF]root.Data
0e6d358a23
[NBF]root.Data
0e6d358a3
[NBF]root.Data
0e6d358a4
[NBF]root.Data
0e6d358a5
[NBF]root.Data
0e6d358a6
[NBF]root.Data
0e6d358a7
[NBF]root.Data
0e6d358a8
[NBF]root.Data
0e6d358a9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
0Lzgk1Mr
Full Name
0Lzgk1Mr
EntryPoint
System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
Scope Name
0Lzgk1Mr
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0Lzgk1Mr
Assembly Version
9.7.30.155
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void Cw4w3TdgWid.tr7SWnz3::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
pop <null>
ret <null>
Module Name
0Lzgk1Mr
Full Name
0Lzgk1Mr
EntryPoint
System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
Scope Name
0Lzgk1Mr
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0Lzgk1Mr
Assembly Version
9.7.30.155
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void Cw4w3TdgWid.tr7SWnz3::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void Mks6s9N.ai1Z0tF/Jqt84sH.7jeZXo3::Pw3if9RamFx7()
pop <null>
ret <null>
c981b8144e2aebd6080858b04af3b600
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ⴓ.ai1Z0tF.resources
0Lzgk1Mr.g.resources
c363278114c850.Resources.resources
0e6d358a0
[NBF]root.Data
0e6d358a1
[NBF]root.Data
0e6d358a10
[NBF]root.Data
0e6d358a11
[NBF]root.Data
0e6d358a12
[NBF]root.Data
0e6d358a13
[NBF]root.Data
0e6d358a14
[NBF]root.Data
0e6d358a15
[NBF]root.Data
0e6d358a16
[NBF]root.Data
0e6d358a17
[NBF]root.Data
0e6d358a18
[NBF]root.Data
0e6d358a19
[NBF]root.Data
0e6d358a2
[NBF]root.Data
0e6d358a20
[NBF]root.Data
0e6d358a21
[NBF]root.Data
0e6d358a22
[NBF]root.Data
0e6d358a23
[NBF]root.Data
0e6d358a3
[NBF]root.Data
0e6d358a4
[NBF]root.Data
0e6d358a5
[NBF]root.Data
0e6d358a6
[NBF]root.Data
0e6d358a7
[NBF]root.Data
0e6d358a8
[NBF]root.Data
0e6d358a9
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙