d4f979982497cc521865ea2033df5627

PE Executable

MD5: d4f979982497cc521865ea2033df5627

Size: 3.45 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	d4f979982497cc521865ea2033df5627
Sha1	7391e54cdad74d4c6f7f91afa957f8c1200b7c24
Sha256	c4c2a82a7d454bb85fa22f12d2571639c1640ba4a6790d708f4a229f91a7a99b
Sha384	90af78c8809e03f3c84745f9023c9c8bd284dbf3ffd14e5732b11d1bd78ae39dcda928fa3ada11609b8cc30d3124fb8b
Sha512	5390d80a08e5bb55be3e0375c5e012aa792155bef8a3bcfaf9c44a67c5e1923d619af8a7b0bfa646588af7661d68d84ac165cfb1140956d240dfaffba9b33cfa
SSDeep	49152:vyU/eYiATYJoMwfMDpsAgghYek8GI+EekPoVEixGaSUFk5Z3M01wsHY/jm:vnvNhDEDLzxhCYoVEixpqZc01bHGj
TLSH	7AF5E0417E04CE11F0191673C2EF084487F099956BA6E32B7DBA376E58123AB7C8D9DB

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	OeKZbku99JhfOe
Full Name	OeKZbku99JhfOe
EntryPoint	System.Void GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::xcfcAVSGyi()
Scope Name	OeKZbku99JhfOe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JLbwcNBC07bRiGauAW7gVaHt9PAUilBX3CO0Pem
Assembly Version	0.2.4.3
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::xcfcAVSGyi()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void r6qfPucWiRHO9mBUZbY.suLs0HcHdPMJIoSd6MA::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::MuacKKSkAZ callvirt System.Void yl2FcwXHAdntdBjWWMu.Ss2nngXpvbT5ryvLQEy::hhY9kru6fy() nop <null> ret <null>`
Module Name	OeKZbku99JhfOe
Full Name	OeKZbku99JhfOe
EntryPoint	System.Void GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::xcfcAVSGyi()
Scope Name	OeKZbku99JhfOe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JLbwcNBC07bRiGauAW7gVaHt9PAUilBX3CO0Pem
Assembly Version	0.2.4.3
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::xcfcAVSGyi()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void r6qfPucWiRHO9mBUZbY.suLs0HcHdPMJIoSd6MA::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object GWOeOeXsL0Jhm6XB6MP.GRRLrLXgs5KmyHalO2b::MuacKKSkAZ callvirt System.Void yl2FcwXHAdntdBjWWMu.Ss2nngXpvbT5ryvLQEy::hhY9kru6fy() nop <null> ret <null>`

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

d4f979982497cc521865ea2033df5627

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

d4f979982497cc521865ea2033df5627

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.