Suspicious
Suspect

PE Executable
MD5: d1a6ab98009518595867b6a4c106f268
Size: 1.31 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d1a6ab98009518595867b6a4c106f268
Sha1 e897170e95606ed06e9a2ff3fd593643facfd138
Sha256 2f4de4bd0ba8bff96a2b2f8fe3703d0bea4dac48f6442cbd75677b3da8a4bb4f
Sha384 3d739d3ddd6bac87c9f62300f3cee08b1f99f12653adcff7d9f0167acd1c5e30ad24a20c6d5fe43ca983c3499853764f
Sha512 7a583dd15149dd7028f1fe8fb68fa7b613d0546eccbbfdfe7aef08b6a451663c71989ef8583dc2cbc8ed250bb0e83bfe4ee7d52e2be7de776af5b31113081c5f
SSDeep 24576:4dZZzdCJvkYzllNkPbdb9tV2CCuUMQziTSC2Q6RE:4vZzdizzjepb96LuUMdcN
TLSH D855F12917E94A14F0FF5B38B77800680BF0BC2B9A31E66E6A5651DD0E61F49ED21373
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d1a6ab98009518595867b6a4c106f268
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
7waLxJ5q2ae.g.resources
7waLxJ5q2ae.Resources.resources
46f56d277d3ef6.Resources.resources
2a8255e80
[NBF]root.Data
2a8255e81
[NBF]root.Data
2a8255e810
[NBF]root.Data
2a8255e811
[NBF]root.Data
2a8255e812
[NBF]root.Data
2a8255e813
[NBF]root.Data
2a8255e814
[NBF]root.Data
2a8255e815
[NBF]root.Data
2a8255e816
[NBF]root.Data
2a8255e817
[NBF]root.Data
2a8255e818
[NBF]root.Data
2a8255e819
[NBF]root.Data
2a8255e82
[NBF]root.Data
2a8255e820
[NBF]root.Data
2a8255e821
[NBF]root.Data
2a8255e822
[NBF]root.Data
2a8255e823
[NBF]root.Data
2a8255e824
[NBF]root.Data
2a8255e825
[NBF]root.Data
2a8255e826
[NBF]root.Data
2a8255e827
[NBF]root.Data
2a8255e828
[NBF]root.Data
2a8255e829
[NBF]root.Data
2a8255e83
[NBF]root.Data
2a8255e830
[NBF]root.Data
2a8255e831
[NBF]root.Data
2a8255e832
[NBF]root.Data
2a8255e833
[NBF]root.Data
2a8255e834
[NBF]root.Data
2a8255e835
[NBF]root.Data
2a8255e836
[NBF]root.Data
2a8255e837
[NBF]root.Data
2a8255e84
[NBF]root.Data
2a8255e85
[NBF]root.Data
2a8255e86
[NBF]root.Data
2a8255e87
[NBF]root.Data
2a8255e88
[NBF]root.Data
2a8255e89
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
7waLxJ5q2ae
Full Name
7waLxJ5q2ae
EntryPoint
System.Void 7waLxJ5q2ae.0naYCm3pkkN57/qAq1W.km5LwKq7R::sFz9H3wf()
Scope Name
7waLxJ5q2ae
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7waLxJ5q2ae
Assembly Version
22.20.3.288
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void 7waLxJ5q2ae.0naYCm3pkkN57/qAq1W.km5LwKq7R::sFz9H3wf()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void 7waLxJ5q2ae.tLe7bq::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
Module Name
7waLxJ5q2ae
Full Name
7waLxJ5q2ae
EntryPoint
System.Void 7waLxJ5q2ae.0naYCm3pkkN57/qAq1W.km5LwKq7R::sFz9H3wf()
Scope Name
7waLxJ5q2ae
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7waLxJ5q2ae
Assembly Version
22.20.3.288
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1195
Main Method
System.Void 7waLxJ5q2ae.0naYCm3pkkN57/qAq1W.km5LwKq7R::sFz9H3wf()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void 7waLxJ5q2ae.tLe7bq::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
d1a6ab98009518595867b6a4c106f268
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
7waLxJ5q2ae.g.resources
7waLxJ5q2ae.Resources.resources
46f56d277d3ef6.Resources.resources
2a8255e80
[NBF]root.Data
2a8255e81
[NBF]root.Data
2a8255e810
[NBF]root.Data
2a8255e811
[NBF]root.Data
2a8255e812
[NBF]root.Data
2a8255e813
[NBF]root.Data
2a8255e814
[NBF]root.Data
2a8255e815
[NBF]root.Data
2a8255e816
[NBF]root.Data
2a8255e817
[NBF]root.Data
2a8255e818
[NBF]root.Data
2a8255e819
[NBF]root.Data
2a8255e82
[NBF]root.Data
2a8255e820
[NBF]root.Data
2a8255e821
[NBF]root.Data
2a8255e822
[NBF]root.Data
2a8255e823
[NBF]root.Data
2a8255e824
[NBF]root.Data
2a8255e825
[NBF]root.Data
2a8255e826
[NBF]root.Data
2a8255e827
[NBF]root.Data
2a8255e828
[NBF]root.Data
2a8255e829
[NBF]root.Data
2a8255e83
[NBF]root.Data
2a8255e830
[NBF]root.Data
2a8255e831
[NBF]root.Data
2a8255e832
[NBF]root.Data
2a8255e833
[NBF]root.Data
2a8255e834
[NBF]root.Data
2a8255e835
[NBF]root.Data
2a8255e836
[NBF]root.Data
2a8255e837
[NBF]root.Data
2a8255e84
[NBF]root.Data
2a8255e85
[NBF]root.Data
2a8255e86
[NBF]root.Data
2a8255e87
[NBF]root.Data
2a8255e88
[NBF]root.Data
2a8255e89
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙