Suspicious
Suspect

ea887d234f2d219371d2eccd34c06756

PE Executable
MD5: ea887d234f2d219371d2eccd34c06756
Size: 1.35 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 ea887d234f2d219371d2eccd34c06756
Sha1 52f9af3afe203216f7b4a4a1519a8d02f0f69312
Sha256 c65751f053c867b9ee2267bc61377c4165d86ff1a52a10eb2808a49d124f5eb5
Sha384 e5e5e5bdb74dec3c527011b8f7dc23eb49a4b0bc1a1f3ab6a586c14cc5f3cb9e935ff86003ad10b4e446bb4224628a90
Sha512 4db093571a0230438f79177d62491b751d1028cf71f02668e887c3fd32b4b007a04e5b4a4cc6d9859d5ae9e22035108dc9a0e9e8a84adfd6fd0a6b07ff0f86a6
SSDeep 24576:MOnTF/fb39Z1JXJ0GCnRveYepqMKDmfC4KOSSn2R6SDAf0B:MITBfb9ZnXURveYkqM3fC41p2tY0B
TLSH FD55010617E446A8F0FE8B74AAB8046543F1F917D329EB6E798840FE8D21BC4D952773
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ea887d234f2d219371d2eccd34c06756
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ty9bq2pSHi8is.g.resources
Ty9bq2pSHi8is.Resources.resources
6cd54cae564326.Resources.resources
6509bb690
[NBF]root.Data
6509bb691
[NBF]root.Data
6509bb6910
[NBF]root.Data
6509bb6911
[NBF]root.Data
6509bb6912
[NBF]root.Data
6509bb6913
[NBF]root.Data
6509bb6914
[NBF]root.Data
6509bb6915
[NBF]root.Data
6509bb6916
[NBF]root.Data
6509bb6917
[NBF]root.Data
6509bb6918
[NBF]root.Data
6509bb6919
[NBF]root.Data
6509bb692
[NBF]root.Data
6509bb6920
[NBF]root.Data
6509bb6921
[NBF]root.Data
6509bb6922
[NBF]root.Data
6509bb6923
[NBF]root.Data
6509bb6924
[NBF]root.Data
6509bb6925
[NBF]root.Data
6509bb6926
[NBF]root.Data
6509bb6927
[NBF]root.Data
6509bb6928
[NBF]root.Data
6509bb6929
[NBF]root.Data
6509bb693
[NBF]root.Data
6509bb6930
[NBF]root.Data
6509bb6931
[NBF]root.Data
6509bb6932
[NBF]root.Data
6509bb6933
[NBF]root.Data
6509bb6934
[NBF]root.Data
6509bb6935
[NBF]root.Data
6509bb6936
[NBF]root.Data
6509bb6937
[NBF]root.Data
6509bb6938
[NBF]root.Data
6509bb6939
[NBF]root.Data
6509bb694
[NBF]root.Data
6509bb6940
[NBF]root.Data
6509bb6941
[NBF]root.Data
6509bb695
[NBF]root.Data
6509bb696
[NBF]root.Data
6509bb697
[NBF]root.Data
6509bb698
[NBF]root.Data
6509bb699
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ty9bq2pSHi8is
Full Name
Ty9bq2pSHi8is
EntryPoint
System.Void Ty9bq2pSHi8is.Rkp98Ndzg4/rZc1oi8.Raq9dg8::0esDx1Qz9()
Scope Name
Ty9bq2pSHi8is
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ty9bq2pSHi8is
Assembly Version
9.6.29.150
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1089
Main Method
System.Void Ty9bq2pSHi8is.Rkp98Ndzg4/rZc1oi8.Raq9dg8::0esDx1Qz9()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void Ty9bq2pSHi8is.xZp82pXzF6yo4::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
Module Name
Ty9bq2pSHi8is
Full Name
Ty9bq2pSHi8is
EntryPoint
System.Void Ty9bq2pSHi8is.Rkp98Ndzg4/rZc1oi8.Raq9dg8::0esDx1Qz9()
Scope Name
Ty9bq2pSHi8is
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ty9bq2pSHi8is
Assembly Version
9.6.29.150
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1089
Main Method
System.Void Ty9bq2pSHi8is.Rkp98Ndzg4/rZc1oi8.Raq9dg8::0esDx1Qz9()
Main IL Instruction Count
39
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0027: ldc.i4.s 100
ldstr 1.6.4.9
stloc.0 <null>
ldc.i4.s 100
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr AppConfig.dat
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
newobj System.Void Ty9bq2pSHi8is.xZp82pXzF6yo4::.ctor()
stloc.2 <null>
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
leave.s IL_0067: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0067: nop
nop <null>
ret <null>
ea887d234f2d219371d2eccd34c06756
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ty9bq2pSHi8is.g.resources
Ty9bq2pSHi8is.Resources.resources
6cd54cae564326.Resources.resources
6509bb690
[NBF]root.Data
6509bb691
[NBF]root.Data
6509bb6910
[NBF]root.Data
6509bb6911
[NBF]root.Data
6509bb6912
[NBF]root.Data
6509bb6913
[NBF]root.Data
6509bb6914
[NBF]root.Data
6509bb6915
[NBF]root.Data
6509bb6916
[NBF]root.Data
6509bb6917
[NBF]root.Data
6509bb6918
[NBF]root.Data
6509bb6919
[NBF]root.Data
6509bb692
[NBF]root.Data
6509bb6920
[NBF]root.Data
6509bb6921
[NBF]root.Data
6509bb6922
[NBF]root.Data
6509bb6923
[NBF]root.Data
6509bb6924
[NBF]root.Data
6509bb6925
[NBF]root.Data
6509bb6926
[NBF]root.Data
6509bb6927
[NBF]root.Data
6509bb6928
[NBF]root.Data
6509bb6929
[NBF]root.Data
6509bb693
[NBF]root.Data
6509bb6930
[NBF]root.Data
6509bb6931
[NBF]root.Data
6509bb6932
[NBF]root.Data
6509bb6933
[NBF]root.Data
6509bb6934
[NBF]root.Data
6509bb6935
[NBF]root.Data
6509bb6936
[NBF]root.Data
6509bb6937
[NBF]root.Data
6509bb6938
[NBF]root.Data
6509bb6939
[NBF]root.Data
6509bb694
[NBF]root.Data
6509bb6940
[NBF]root.Data
6509bb6941
[NBF]root.Data
6509bb695
[NBF]root.Data
6509bb696
[NBF]root.Data
6509bb697
[NBF]root.Data
6509bb698
[NBF]root.Data
6509bb699
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙