Suspicious
Suspect

e2ad1bddc8d34238225a5cfbb456bef8

PE Executable
MD5: e2ad1bddc8d34238225a5cfbb456bef8
Size: 165.38 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 e2ad1bddc8d34238225a5cfbb456bef8
Sha1 a1087b7f46cc33dcf794bb53bb180f7e4796fd3a
Sha256 e0be0a8c8c741e821bea2b66c2aea511e33da9aaf9199a30f6df4dd1ba36f980
Sha384 040108f468c3784ec82c91ed37573640f4c5a0816ca17c4b4d9455b32bc47f558aff4ff537e60e1eb96c86c6e9decf01
Sha512 af9c32fade5e06b4443d86917b1f85d59fab7df003970c5c3491463092d0f6067d474bb9f7fae6f1beec4f21a3776f94b8b5fbc3bcb15423304c76781342619c
SSDeep 3072:y9aH7fFuyMf1pX9VHQy3+T9V6ys2IEEUAzMlzriX5ZUblMq9Cb:y9aHjFF0zB3+TDNNlriXz4lMq9C
TLSH C2F302B341F48266CAF9F4F66D6EE3400BE5F11BAF67895D04EC9860BC7509980F22B4
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e2ad1bddc8d34238225a5cfbb456bef8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
kfwf.Resources
RC7_UI.exe
Runtime Broker.exe
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
RC7.exe
Full Name
RC7.exe
EntryPoint
System.Void Program::Main()
Scope Name
RC7.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RC7
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
19
Main Method
System.Void Program::Main()
Main IL Instruction Count
39
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007C: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_007A: br.s IL_0083
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007A: br.s IL_0083
br.s IL_0083: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
RC7.exe
Full Name
RC7.exe
EntryPoint
System.Void Program::Main()
Scope Name
RC7.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RC7
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
19
Main Method
System.Void Program::Main()
Main IL Instruction Count
39
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007C: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_007A: br.s IL_0083
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007A: br.s IL_0083
br.s IL_0083: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
e2ad1bddc8d34238225a5cfbb456bef8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
kfwf.Resources
RC7_UI.exe
Runtime Broker.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙