Suspicious
Suspect

c9f12695f1205356ef2c2c256d42e0fe

PE Executable
MD5: c9f12695f1205356ef2c2c256d42e0fe
Size: 3.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 c9f12695f1205356ef2c2c256d42e0fe
Sha1 a3406b585ba7388567854d5b02b3fd74bb29a7f5
Sha256 b482ef65f7b4a5fd31fa82079f33dce56471710b5049f78e794dfac0cdb823c8
Sha384 05a382cedaf3a2a68971cf175ec2f171042103da29082ad4875118dccf9afc888474ad60757405532a4262e93eda4055
Sha512 decd9b1ae2613a49e1dfb5538e7626c53319c8e7969acb9bf04eceabbdb534903a76f579a1dbdb84c0c62df4240d2f9f7318dba189fc16a0506c5f99d8851926
SSDeep 49152:uwT1+vozUdzQyySmpcAcZgEO3JcoGd+PTHHB72eh2NT:uwYvozUdzQyySmpcPZgi
TLSH DEE55B1437F85E27E1AFE77396B00052A7F0FC1AB363E70B6581A67A1C53B509801BA7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
c9f12695f1205356ef2c2c256d42e0fe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
10.0.26100.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Info
PE Detect: PeReader OK (file layout)
Total Strings
11129
Main Method
System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::ԩ菭᜗཯⦌툶繁鏺旜킪刿햤方塕콣ᎂ秷੓䷝(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Ɍ偪八쇸춒畕鍜ﰾ᪰꾰〚䢈쨛헼৲닼땿ᾙ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 꽞ഋ團콨靁撹厚鏜汦穻㛔ݖ䖚盘韚櫛㢺˻::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
10.0.26100.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11129
Main Method
System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::ԩ菭᜗཯⦌툶繁鏺旜킪刿햤方塕콣ᎂ秷੓䷝(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 酩照郄꼂폵薾큭芿澾켼掅貋둤�炴❠㆑::Ɍ偪八쇸춒畕鍜ﰾ᪰꾰〚䢈쨛헼৲닼땿ᾙ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 꽞ഋ團콨靁撹厚鏜汦穻㛔ݖ䖚盘韚櫛㢺˻::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
c9f12695f1205356ef2c2c256d42e0fe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙