Suspicious
Suspect

PE Executable
MD5: d2471d297e317cacb907c683dc9e47c7
Size: 1.2 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 d2471d297e317cacb907c683dc9e47c7
Sha1 b45db8f89700a12845d3e6315f83003e21627d5e
Sha256 79da3ea43027ba149ea557a9999d25b1df682d06606e68d39e62a86b01d41f4b
Sha384 517a696daa19936ea872c224b5445f068d661844acd5db3dbf1ba1a7d90eadef97d12ec6f8f2465a8e7f58104f4ecdee
Sha512 b20bb4cc6c5ec12228a6c03c00c718dfd83e698dcda3463d60feb73eae17a1e5cc467fd166f36f511d0cf6f80c3a14f3974146d3ad097d6b2dcffda877106b51
SSDeep 12288:O5PoO8lcGb3HVX88wEAM952nAfIptn+foQgN+Ht/pqMJsDmfC/gyvCSOW9SdVpUO:cPo7t8YCnRveYepqMKDmfC4KOSSn2K6
TLSH CE456BDE53911993E16EAB70B524802905B16CCF2821D6F724C0709EFBB1AC69E537EF
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d2471d297e317cacb907c683dc9e47c7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
IP NORMAL CRY.Balinmayd.resources
$this.Icon
[NBF]root.IconData
IP NORMAL CRY.GradianolCamni.resources
AxWindowsMediaPlayer1.OcxState
IP NORMAL CRY.Resources.resources
IP NORMAL CRY.81905471.png
6127a470170e2a.Resources.resources
351e14050
[NBF]root.Data
351e14051
[NBF]root.Data
351e140510
[NBF]root.Data
351e140511
[NBF]root.Data
351e140512
[NBF]root.Data
351e140513
[NBF]root.Data
351e140514
[NBF]root.Data
351e140515
[NBF]root.Data
351e140516
[NBF]root.Data
351e140517
[NBF]root.Data
351e140518
[NBF]root.Data
351e140519
[NBF]root.Data
351e14052
[NBF]root.Data
351e140520
[NBF]root.Data
351e140521
[NBF]root.Data
351e140522
[NBF]root.Data
351e140523
[NBF]root.Data
351e140524
[NBF]root.Data
351e140525
[NBF]root.Data
351e140526
[NBF]root.Data
351e140527
[NBF]root.Data
351e140528
[NBF]root.Data
351e140529
[NBF]root.Data
351e14053
[NBF]root.Data
351e140530
[NBF]root.Data
351e140531
[NBF]root.Data
351e140532
[NBF]root.Data
351e140533
[NBF]root.Data
351e140534
[NBF]root.Data
351e140535
[NBF]root.Data
351e140536
[NBF]root.Data
351e140537
[NBF]root.Data
351e140538
[NBF]root.Data
351e140539
[NBF]root.Data
351e14054
[NBF]root.Data
351e140540
[NBF]root.Data
351e140541
[NBF]root.Data
351e14055
[NBF]root.Data
351e14056
[NBF]root.Data
351e14057
[NBF]root.Data
351e14058
[NBF]root.Data
351e14059
[NBF]root.Data
Name Value
Module Name
IP NORMAL CRY
Full Name
IP NORMAL CRY
EntryPoint
System.Void So06Qj.a8Q0::Hy62()
Scope Name
IP NORMAL CRY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
IP NORMAL CRY
Assembly Version
3.2.7.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2632
Main Method
System.Void So06Qj.a8Q0::Hy62()
Main IL Instruction Count
14
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldstr 81905471.png
call System.Void So06Qj.Hd2b::w8TEn3(System.String)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
Module Name
IP NORMAL CRY
Full Name
IP NORMAL CRY
EntryPoint
System.Void So06Qj.a8Q0::Hy62()
Scope Name
IP NORMAL CRY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
IP NORMAL CRY
Assembly Version
3.2.7.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
2632
Main Method
System.Void So06Qj.a8Q0::Hy62()
Main IL Instruction Count
14
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldstr 81905471.png
call System.Void So06Qj.Hd2b::w8TEn3(System.String)
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
d2471d297e317cacb907c683dc9e47c7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
IP NORMAL CRY.Balinmayd.resources
$this.Icon
[NBF]root.IconData
IP NORMAL CRY.GradianolCamni.resources
AxWindowsMediaPlayer1.OcxState
IP NORMAL CRY.Resources.resources
IP NORMAL CRY.81905471.png
6127a470170e2a.Resources.resources
351e14050
[NBF]root.Data
351e14051
[NBF]root.Data
351e140510
[NBF]root.Data
351e140511
[NBF]root.Data
351e140512
[NBF]root.Data
351e140513
[NBF]root.Data
351e140514
[NBF]root.Data
351e140515
[NBF]root.Data
351e140516
[NBF]root.Data
351e140517
[NBF]root.Data
351e140518
[NBF]root.Data
351e140519
[NBF]root.Data
351e14052
[NBF]root.Data
351e140520
[NBF]root.Data
351e140521
[NBF]root.Data
351e140522
[NBF]root.Data
351e140523
[NBF]root.Data
351e140524
[NBF]root.Data
351e140525
[NBF]root.Data
351e140526
[NBF]root.Data
351e140527
[NBF]root.Data
351e140528
[NBF]root.Data
351e140529
[NBF]root.Data
351e14053
[NBF]root.Data
351e140530
[NBF]root.Data
351e140531
[NBF]root.Data
351e140532
[NBF]root.Data
351e140533
[NBF]root.Data
351e140534
[NBF]root.Data
351e140535
[NBF]root.Data
351e140536
[NBF]root.Data
351e140537
[NBF]root.Data
351e140538
[NBF]root.Data
351e140539
[NBF]root.Data
351e14054
[NBF]root.Data
351e140540
[NBF]root.Data
351e140541
[NBF]root.Data
351e14055
[NBF]root.Data
351e14056
[NBF]root.Data
351e14057
[NBF]root.Data
351e14058
[NBF]root.Data
351e14059
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙