Suspicious
Suspect

PE Executable
MD5: ea4074142cbc09d33f8a6a065f02cbf4
Size: 1.09 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 ea4074142cbc09d33f8a6a065f02cbf4
Sha1 9a0d9ecd99ae139c063b12c5f6ad1dbf5ede0aee
Sha256 1626d048d160be512ed5e4e9755c924980a09d1759216ff3ea2966a0347d0ce7
Sha384 b31f20542979e234d93673fb2c4ba6c705e7f13439deb3f50953594da6a0c93bc55969ce273b857a245fcd37ae9b5f54
Sha512 beb4992b7d47e397b28b506d6ff5513014d16249a972670262e524c81af2dc4ba648b59821a8735d41d1850171a13ada17a790ea01120ce1e0767c308bdb1f1b
SSDeep 24576:EwVOxM9O9z6Ywu2j/7McRqyHiJ99unipdBkMgQex9edMNRJM:NVOc/wcR5HizgB94MzJ
TLSH 173533ED8B4442D8DE36B37F9EF3E88A18A966AE5C63F117B507134A413D315CA09BD0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ea4074142cbc09d33f8a6a065f02cbf4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fontnnu.Properties.Resources.resources
Kopqqha
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
am.exe
Full Name
am.exe
EntryPoint
System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Scope Name
am.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
am
Assembly Version
1.0.8173.14647
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
6
Main Method
System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Main IL Instruction Count
32
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0059: ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher
ret <null>
ldsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher
dup <null>
brfalse IL_0039: pop
br IL_006F: call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>)
pop <null>
ldc.i4 0
ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21
ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_3a9c0534745e416fa99183f70ec508f9
brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher
ldftn System.Void am.Matching.CommonMatcher/<>c::MatchBasicMatcher(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher
call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>)
ldc.i4 2
ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21
ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_83c1dddff80d4681acc2f332325e9271
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name
am.exe
Full Name
am.exe
EntryPoint
System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Scope Name
am.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
am
Assembly Version
1.0.8173.14647
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
6
Main Method
System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Main IL Instruction Count
32
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0059: ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher
ret <null>
ldsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher
dup <null>
brfalse IL_0039: pop
br IL_006F: call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>)
pop <null>
ldc.i4 0
ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21
ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_3a9c0534745e416fa99183f70ec508f9
brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher
ldftn System.Void am.Matching.CommonMatcher/<>c::MatchBasicMatcher(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher
call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>)
ldc.i4 2
ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21
ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_83c1dddff80d4681acc2f332325e9271
brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ea4074142cbc09d33f8a6a065f02cbf4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fontnnu.Properties.Resources.resources
Kopqqha
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙