Deep Malware Analysis of e715b90edac6ea3b5f86fa141568cecf | md5: e715b90edac6ea3b5f86fa141568cecf | Executable | PE (Portable Executable) | Win 64 Exe | x64 | .Net | SOS: 0.47 | SOS: 0.01

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Name	Value
Module Name	shutdown.exe
Full Name	shutdown.exe
EntryPoint	`System.Void cQUgGuBMbLRJQlHySwOzBgYvmrBZYMDFuxRChfediGvk.ZgurhSBRCEOsWfxSbzgJcTWwZMIpsLesoatpxCNzZYLraR::aDaNXEIUTUpfHsJhHDqcTcIUwcsSNzJdcGVhUefBNtgBQwca(System.String[])`
Scope Name	shutdown.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	shutdown
Assembly Version	6.2.26100.1
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	33
Main Method	`System.Void cQUgGuBMbLRJQlHySwOzBgYvmrBZYMDFuxRChfediGvk.ZgurhSBRCEOsWfxSbzgJcTWwZMIpsLesoatpxCNzZYLraR::aDaNXEIUTUpfHsJhHDqcTcIUwcsSNzJdcGVhUefBNtgBQwca(System.String[])`
Main IL Instruction Count	6
Main IL	call System.Boolean Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::get_UseCompatibleTextRendering() call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call cQUgGuBMbLRJQlHySwOzBgYvmrBZYMDFuxRChfediGvk.ZgurhSBRCEOsWfxSbzgJcTWwZMIpsLesoatpxCNzZYLraR SVMKyhvyUlCuEOhEXYFqQZHDRBaSseSUonVCWzIKIkylUKHXGFkGfqYyARbfHoedDuDNFbLS.qkGepHWhIQkeARcDMsWCZmtFRCdAKWMPKdxboarxer::get_Application() ldarg.0 <null> callvirt System.Void Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase::Run(System.String[]) ret <null>

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Embedded Resources UNKNWOWNsuspect

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.