Deep Malware Analysis of ddeb98aef74364d5068836f404613d92 | md5: ddeb98aef74364d5068836f404613d92 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net | SOS: 0.32

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	ddeb98aef74364d5068836f404613d92
Sha1	6c672941ca5610ea2b50863fdfdac6180645986c
Sha256	60977eca0c78ae08cb9a2ea3a52ce0f8b49f3df7522b5fb5ee8eeb1a46510f56
Sha384	0cf2519833535570596b39458bd502bff7f8b036eaa00de508b676945e6d5186a6b7bd9be89ca961829d52a0aa4b5da9
Sha512	f82e8a077fa66fa65f4cb450da2bb92884aac4087c7b1abf4cc7629620cc6fd99f30a0970db6dc2d411cbd11ddfbf89f10f4c87d3cc659e0f359fc59b2d013e0
SSDeep	49152:3YNnGDNaciFItbKJZ6HlTbFav4l+ZzEUINav8aOuMBNn4VBj6Og6n/QwS2Ke:oJUNdiFItAZ6HlHFpUJvVOuy4V5a6/QG
TLSH	1FD52398661AE913CB5423344AB2F2744278AFDEB901D22B5FD9BEFB7931F410C405A7

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	YSNH.exe
Full Name	YSNH.exe
EntryPoint	System.Void ChimneySweep.Program::Main()
Scope Name	YSNH.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	YSNH
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	181
Main Method	System.Void ChimneySweep.Program::Main()
Main IL Instruction Count	12
Main IL	nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldstr !!!!!!!!!!!!!!!!!!!634C635A!!!!!!!!!!!!!!!!!!!636269!!!!!!!!!!!!!!!!!!!admin!!!!!!!!!!!!!!!!!!!123456 ldstr newobj System.Void ChimneySweep.DachForm::.ctor(System.String,System.String) call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>