Deep Malware Analysis of d745bfd36ed7a54ad61487c31b7af874 | md5: d745bfd36ed7a54ad61487c31b7af874 | .Net | PE (Portable Executable) | SOS: 0.22 | Executable | Managed .NET | PE File Layout | Win 64 Exe | x64 | PDB Path

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	d745bfd36ed7a54ad61487c31b7af874
Sha1	d767ab423214a64c076f882ff099252fed9feecb
Sha256	eda6ed7f7f715c8dc16793bebf83784bf6d405ed2cd8576202175f9a893601b3
Sha384	dfad977edb89b84c8b44f384c869c8c8f1038d0f7ba90b9d08c2c1eb3eda6ba7edfee54e43aed85e0bf23adcf23078a1
Sha512	9310b5734445c82b0028491807d46f07070029ee480334393f16b0e2f1a5022207dbc4c890a6010d24ec4aba812fcdbcd654c6b0ffd99fab15ce7c8bc006ae66
SSDeep	96:sjgBc9d/i1XbJ+UbuWc1vYU+xV9IzufO0zNt:sIqinLSWc1QLLIzH+
TLSH	ACC1EB8997FD13B1E6F54B3468BBA3041B70ED058D269BCF264C32A97E91E803D52672

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Module Name	CopilotService.exe
Full Name	CopilotService.exe
EntryPoint	System.Void CopilotService.Program::Main(System.String[])
Scope Name	CopilotService.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	CopilotService
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	1
Main Method	System.Void CopilotService.Program::Main(System.String[])
Main IL Instruction Count	98
Main IL	nop <null> call System.Void CopilotService.Program::HideOwnConsole() nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.UnhandledExceptionEventHandler CopilotService.Program/<>c::<>9__13_0 dup <null> brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_0(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.UnhandledExceptionEventHandler CopilotService.Program/<>c::<>9__13_0 callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.EventHandler CopilotService.Program/<>c::<>9__13_1 dup <null> brtrue.s IL_0055: callvirt System.Void System.AppDomain::add_ProcessExit(System.EventHandler) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_1(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.EventHandler CopilotService.Program/<>c::<>9__13_1 callvirt System.Void System.AppDomain::add_ProcessExit(System.EventHandler) nop <null> ldsfld System.Action CopilotService.Program/<>c::<>9__13_2 dup <null> brtrue.s IL_007A: call System.Void CopilotService.Program::Try(System.Action) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_2() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CopilotService.Program/<>c::<>9__13_2 call System.Void CopilotService.Program::Try(System.Action) nop <null> ldsfld System.Action CopilotService.Program/<>c::<>9__13_3 dup <null> brtrue.s IL_009F: call System.Void CopilotService.Program::Try(System.Action) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_3() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CopilotService.Program/<>c::<>9__13_3 call System.Void CopilotService.Program::Try(System.Action) nop <null> ldsfld System.Action CopilotService.Program/<>c::<>9__13_4 dup <null> brtrue.s IL_00C4: call System.Void CopilotService.Program::Try(System.Action) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_4() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CopilotService.Program/<>c::<>9__13_4 call System.Void CopilotService.Program::Try(System.Action) nop <null> ldsfld System.Action CopilotService.Program/<>c::<>9__13_5 dup <null> brtrue.s IL_00E9: call System.Void CopilotService.Program::Try(System.Action) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_5() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CopilotService.Program/<>c::<>9__13_5 call System.Void CopilotService.Program::Try(System.Action) nop <null> ldsfld System.Action CopilotService.Program/<>c::<>9__13_6 dup <null> brtrue.s IL_010E: call System.Void CopilotService.Program::Try(System.Action) pop <null> ldsfld CopilotService.Program/<>c CopilotService.Program/<>c::<>9 ldftn System.Void CopilotService.Program/<>c::<Main>b__13_6() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CopilotService.Program/<>c::<>9__13_6 call System.Void CopilotService.Program::Try(System.Action) nop <null> br.s IL_0128: ldc.i4.1 nop <null> nop <null> ldc.i4.m1 <null> call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> leave.s IL_0127: nop pop <null> nop <null> nop <null> leave.s IL_0127: nop nop <null> ldc.i4.1 <null> stloc.0 <null> br.s IL_0116: nop
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\SX\files\obj\x64\Debug\CopilotService.pdb