Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: cdd42dc7fde55600b226f27181d96120
Size: 926.21 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 cdd42dc7fde55600b226f27181d96120
Sha1 5e0a84a5208366f86671eef7699c3f22f6dbc07a
Sha256 2a084e79463e72c0933ec50e0b89aa2cdd5295584b6d6b211da98c5a3b4a8a8c
Sha384 e41b2ec8be5b78fe562dc614d5db9527e8cb1559421b5f16b6fd0ac2c5d1380238b6525c6fe4b62879b9916b61e87733
Sha512 9e1b8ae0e0df14bb229d5defde13e9e92822db50ea264d646f91df9bc3f4f1eb644b6a43a472813f82ad7470aff11c333cc92f24761deab9e858ffa12fd5cff7
SSDeep 24576:s/3l0VmLLduFe6S2rn9RUsc1K7NLoGo0c53:4emEa1ALvM
TLSH FC15CF012BF84A98F5BF97399D311A1487F5F803CB36DB1E2D9850EE1962F819961373
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
cdd42dc7fde55600b226f27181d96120
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Pobregas.67594
Dme5ec7Q.Resources.resources
f7177e680635d0.Resources.resources
071bc7580
[NBF]root.Data
071bc7581
[NBF]root.Data
071bc75810
[NBF]root.Data
071bc75811
[NBF]root.Data
071bc75812
[NBF]root.Data
071bc75813
[NBF]root.Data
071bc75814
[NBF]root.Data
071bc75815
[NBF]root.Data
071bc75816
[NBF]root.Data
071bc75817
[NBF]root.Data
071bc75818
[NBF]root.Data
071bc75819
[NBF]root.Data
071bc7582
[NBF]root.Data
071bc75820
[NBF]root.Data
071bc7583
[NBF]root.Data
071bc7584
[NBF]root.Data
071bc7585
[NBF]root.Data
071bc7586
[NBF]root.Data
071bc7587
[NBF]root.Data
071bc7588
[NBF]root.Data
071bc7589
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Dme5ec7Q
Full Name
Dme5ec7Q
EntryPoint
System.Void Dme5ec7Q.7Ftfw::Ksn04z()
Scope Name
Dme5ec7Q
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dme5ec7Q
Assembly Version
24.21.6.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void Dme5ec7Q.7Ftfw::Ksn04z()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void Dme5ec7Q.rXd3r0N/Yy7f2.7Zxnbj0YCmm::5MicEzw(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
Module Name
Dme5ec7Q
Full Name
Dme5ec7Q
EntryPoint
System.Void Dme5ec7Q.7Ftfw::Ksn04z()
Scope Name
Dme5ec7Q
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dme5ec7Q
Assembly Version
24.21.6.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void Dme5ec7Q.7Ftfw::Ksn04z()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void Dme5ec7Q.rXd3r0N/Yy7f2.7Zxnbj0YCmm::5MicEzw(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙