e1028d0c6d92fd673925b24bff4a475a

PE Executable

MD5: e1028d0c6d92fd673925b24bff4a475a

Size: 849.41 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	e1028d0c6d92fd673925b24bff4a475a
Sha1	627eec15e237971dcc38b7f43c3a35ce6c0db87d
Sha256	d8e23165183fec3c7ea6c15911586ea9dcbe553873f094ac2667d93bfe0487c8
Sha384	ac386bf099634259cf2fd1e06a746d331c1dccefbaea29293825526e0ff86fca0101eadadc087d87716e6e69961ebe1e
Sha512	5c81cb98c660e57f1ab97370c61c05421e40950efc2ef8591ee3050bdc592b6170436e0cba7b7e4ce3b5bcd97d7a49785f131b4f1c5a3c2ed78353909c09bf55
SSDeep	24576:9DZ2qSbucQsw57oCScb5KGoyyFxDybD8pMCJg1I:RZOOsyjbo1FFwIpMP1
TLSH	6205238C79797E6CC68D0F37D16295C94072A065F58BE67509FCAD300F324E8938EEA6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	EoCS.exe
Full Name	EoCS.exe
EntryPoint	System.Void HeRoSorter.Program::Main()
Scope Name	EoCS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	EoCS
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void HeRoSorter.Program::Main()
Main IL Instruction Count	21
Main IL	ldc.i4.4 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void HeRoSorter.MainForm/Ⴀ::Ⴄ() ldc.i4 476 ldc.i4 413 call System.Void HeRoSorter.MainForm/Ⴍ::Ⴐ(System.Int16,System.Int32) ldc.i4.0 <null> ldc.i4 957 ldc.i4 961 call System.Void HeRoSorter.MainForm/Ⴀ::Ⴅ(System.Boolean,System.Int32,System.Char) ldc.i4.3 <null> stloc.1 <null> br.s IL_0002: ldloc.1 newobj System.Void HeRoSorter.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null> ldtoken System.Void HeRoSorter.Program::Main() pop <null> ret <null>
Module Name	EoCS.exe
Full Name	EoCS.exe
EntryPoint	System.Void HeRoSorter.Program::Main()
Scope Name	EoCS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	EoCS
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	2
Main Method	System.Void HeRoSorter.Program::Main()
Main IL Instruction Count	21
Main IL	ldc.i4.4 <null> stloc.1 <null> ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] call System.Void HeRoSorter.MainForm/Ⴀ::Ⴄ() ldc.i4 476 ldc.i4 413 call System.Void HeRoSorter.MainForm/Ⴍ::Ⴐ(System.Int16,System.Int32) ldc.i4.0 <null> ldc.i4 957 ldc.i4 961 call System.Void HeRoSorter.MainForm/Ⴀ::Ⴅ(System.Boolean,System.Int32,System.Char) ldc.i4.3 <null> stloc.1 <null> br.s IL_0002: ldloc.1 newobj System.Void HeRoSorter.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null> ldtoken System.Void HeRoSorter.Program::Main() pop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.