Malicious
Malicious

ea51732cd685078b01a1288f90c887de

Share on LinkedIn
Print
PE Executable
MD5: ea51732cd685078b01a1288f90c887de
Size: 745.98 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 ea51732cd685078b01a1288f90c887de
Sha1 16d8b59cc9139130ee987ebb4bf8bc1789ea3734
Sha256 008f7eb9ebb7a65d3887f263f6c91f8ef340eb220f2167642202b565794fad17
Sha384 9a4b999831695b1b960d2920ac99f6008c22d7f178cba5cc5a09e177925b4c9a87fa4d1483d9322d47274ea006bc9e59
Sha512 cb518a594ba3f77c734f381dd0993955fdf86f9653061d75576048f89b8307a3476a8403690c48d60f738b5c1115685cb4c0a782ff65518264f14fd44abd4329
SSDeep 12288:lNGkMzIY4bTsxv8gTPFveyNasV89pu+L38HnxQTGdp+6dMLhQkELKT4udrRY5o5b:lNyVv8ghvDNx8zV38HnxQTGnVdMlQnK5
TLSH 55F4CE146A56DD12C1E902B1C8D1D1FF52B29E8BE412F2575AC93EAF3A32791F7802C7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ea51732cd685078b01a1288f90c887de
Malicious
.Net Resources
Vu7.zu3.resources
$this.Icon
[NBF]root.IconData
fant.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TeaEstate.Properties.Resources.resources
Pol
[NBF]root.Data
xODd
[NBF]root.Data
[NBF]root.Data-preview.png
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
fant.exe
Full Name
fant.exe
EntryPoint
System.Void Fw.e2::IM()
Scope Name
fant.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fant
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void Fw.e2::IM()
Main IL Instruction Count
43
Main IL 
br IL_0056: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0061: nop
ldsfld CDm.MDS Fw.e2::ex
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0026: nop
nop <null>
ret <null>
nop <null>
newobj System.Void ec1.yc4::.ctor()
stsfld ec1.yc4 Fw.e2::oL
br IL_0047: newobj System.Void Vu7.zu3::.ctor()
newobj System.Void hum.PuS::.ctor()
stsfld hum.PuS Fw.e2::bt
br IL_0078: newobj System.Void bGb.mGJ::.ctor()
newobj System.Void Vu7.zu3::.ctor()
stsfld Vu7.zu3 Fw.e2::gO
br IL_0038: newobj System.Void hum.PuS::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_006C: nop
nop <null>
call System.Void Fw.e2::BN()
br IL_0028: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0096: call System.Void rZs.bZE::sAO()
newobj System.Void bGb.mGJ::.ctor()
stsfld bGb.mGJ Fw.e2::zl
br IL_0087: newobj System.Void CDm.MDS::.ctor()
newobj System.Void CDm.MDS::.ctor()
stsfld CDm.MDS Fw.e2::ex
br IL_0017: ldsfld CDm.MDS Fw.e2::ex
call System.Void rZs.bZE::sAO()
ldc.i4 0
ldsfld <Module>{475f6490-9d6a-4caf-945f-1d863f268878} <Module>{475f6490-9d6a-4caf-945f-1d863f268878}::m_fa7a3edb7c334a23982a5a35aa2a3b9c
ldfld System.Int32 <Module>{475f6490-9d6a-4caf-945f-1d863f268878}::m_d756441db3cf4d38ad21b070a6bf1e5c
brtrue IL_0009: switch(IL_0061)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0061)
Info
PE Detect: PeReader OK (file layout)
Module Name
fant.exe
Full Name
fant.exe
EntryPoint
System.Void Fw.e2::IM()
Scope Name
fant.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fant
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void Fw.e2::IM()
Main IL Instruction Count
43
Main IL 
br IL_0056: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0061: nop
ldsfld CDm.MDS Fw.e2::ex
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0026: nop
nop <null>
ret <null>
nop <null>
newobj System.Void ec1.yc4::.ctor()
stsfld ec1.yc4 Fw.e2::oL
br IL_0047: newobj System.Void Vu7.zu3::.ctor()
newobj System.Void hum.PuS::.ctor()
stsfld hum.PuS Fw.e2::bt
br IL_0078: newobj System.Void bGb.mGJ::.ctor()
newobj System.Void Vu7.zu3::.ctor()
stsfld Vu7.zu3 Fw.e2::gO
br IL_0038: newobj System.Void hum.PuS::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_006C: nop
nop <null>
call System.Void Fw.e2::BN()
br IL_0028: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0096: call System.Void rZs.bZE::sAO()
newobj System.Void bGb.mGJ::.ctor()
stsfld bGb.mGJ Fw.e2::zl
br IL_0087: newobj System.Void CDm.MDS::.ctor()
newobj System.Void CDm.MDS::.ctor()
stsfld CDm.MDS Fw.e2::ex
br IL_0017: ldsfld CDm.MDS Fw.e2::ex
call System.Void rZs.bZE::sAO()
ldc.i4 0
ldsfld <Module>{475f6490-9d6a-4caf-945f-1d863f268878} <Module>{475f6490-9d6a-4caf-945f-1d863f268878}::m_fa7a3edb7c334a23982a5a35aa2a3b9c
ldfld System.Int32 <Module>{475f6490-9d6a-4caf-945f-1d863f268878}::m_d756441db3cf4d38ad21b070a6bf1e5c
brtrue IL_0009: switch(IL_0061)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙