daff672d6a7c4a1c713e195e9fc2be47

PE Executable

MD5: daff672d6a7c4a1c713e195e9fc2be47

Size: 859.65 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	daff672d6a7c4a1c713e195e9fc2be47
Sha1	2c6f60b80bb80ad293ccfb0406515ec45bdd7ce3
Sha256	e74447674de0d55b2b2cde2c6bde58806c411c3f0304d518630bf850145f2cef
Sha384	9ffda920054a1f5b781f9c2bc3afb0a28d4edfd464bf23811e718fa8902b45b4dd2702c7d228c4394c89b4b9f0172b1b
Sha512	fd2f233b0f614c08f82fe50a7680905fe445d1b74c536e0b8cfc1c6eda3b5957f223b30cce0b39ad4da9e662931a54b42ad975d2e26ee9b525816629cfa3270c
SSDeep	24576:5UBSOUm3yJg9R7q4lKbswqgaWqBNjFcnUYzGF9RJ:5UUZmTPw4eUXiUNnRJ
TLSH	390512413284EE01E8A97FB858B0E3721370DFC8E823D317DADEEDE7B9167915605296

Name	Value
Module Name	pCBP.exe
Full Name	pCBP.exe
EntryPoint	System.Void ComplexApp.Program::Main()
Scope Name	pCBP.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	pCBP
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	169
Main Method	System.Void ComplexApp.Program::Main()
Main IL Instruction Count	91
Main IL	nop <null> ldc.i4.0 <null> stloc.0 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_0023: ldloc.2 nop <null> ldloc.0 <null> ldloc.2 <null> conv.r8 <null> ldc.r8 2 call System.Double System.Math::Pow(System.Double,System.Double) conv.i4 <null> ldc.i4.3 <null> rem <null> add <null> stloc.0 <null> nop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4.s 10 clt <null> stloc.3 <null> ldloc.3 <null> brtrue.s IL_0007: nop ldloc.0 <null> ldc.i4.5 <null> cgt <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0044: nop nop <null> ldloc.0 <null> ldc.i4.2 <null> mul <null> ldc.i4.7 <null> sub <null> ldloc.0 <null> ldc.i4.3 <null> div <null> add <null> stloc.0 <null> nop <null> br.s IL_004F: ldloca.s calculationResult nop <null> ldloc.0 <null> ldc.i4.s 42 add <null> ldloc.0 <null> ldc.i4.5 <null> rem <null> sub <null> stloc.0 <null> nop <null> ldloca.s calculationResult call System.String System.Int32::ToString() stloc.1 <null> ldloc.1 <null> callvirt System.Int32 System.String::get_Length() ldc.i4.1 <null> ble.s IL_006D: ldc.i4.0 ldloc.1 <null> ldc.i4.0 <null> callvirt System.Char System.String::get_Chars(System.Int32) ldc.i4.s 49 ceq <null> br.s IL_006E: stloc.s V_5 ldc.i4.0 <null> stloc.s V_5 ldloc.s V_5 brfalse.s IL_0081: call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldloc.1 <null> ldc.i4.s 49 ldc.i4.s 57 callvirt System.String System.String::Replace(System.Char,System.Char) stloc.1 <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldloc.1 <null> newobj System.Void ComplexApp.Form1::.ctor(System.String) call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

PDB Path PATH

pChuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

pChuhuhuhu

daff672d6a7c4a1c713e195e9fc2be47

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.