Suspicious
Suspect

ea891174ee65d94398487735e48c7c2d

PE Executable
MD5: ea891174ee65d94398487735e48c7c2d
Size: 1.63 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 ea891174ee65d94398487735e48c7c2d
Sha1 6b948cc8a2f0df1d73356c31babf9abb00400bd7
Sha256 61cebdb49a8a52bb4d282c873f1ead58ee6b0583d22adefda10cd3cfc2e3d1b4
Sha384 b9c6cc6b83ed3de1e99f5defbb842ace32a426dc7e045f2b375e0f0e31b9ee6bbb99ac15368723194deea3df21fa03e6
Sha512 845978de5d514f8d71fb94a96cfa87f0251390849c31090263308aac2639035fe88fbca552bb852fc50bda3319c27986428f60b6c52331d2f76d0e4b4525a545
SSDeep 49152:oaetjJJJ8DCY51O4mTPmUQxGWcDVtmGR3J8uR5xGJrjnGnweVGOK40Gin9tb8FDG:oHa
TLSH 557509322B7959A2F76F0E35CCA1E53143BB745F13F248BBB9602AC337116C1B909999
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
ea891174ee65d94398487735e48c7c2d
Overlay_7ecd8ad2.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
turbojpeg.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 3
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_7ecd8ad2.bin (1536 bytes)
Module Name
AppXDeployment58.exe
Full Name
AppXDeployment58.exe
EntryPoint
System.Void CachedHandleProvider::Main()
Scope Name
AppXDeployment58.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AppXDeployment58
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
800
Main Method
System.Void CachedHandleProvider::Main()
Main IL Instruction Count
131
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0197: ret
ldloc.0 <null>
brtrue.s IL_0091: ldloc.0
ldloc.1 <null>
brfalse.s IL_002F: leave.s IL_003D
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_003D: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: ldnull
ldnull <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_008C: ldloc.2
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brfalse.s IL_0060: nop
leave.s IL_0091: ldloc.0
nop <null>
ldloc.1 <null>
brfalse.s IL_006A: leave.s IL_0078
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_0078: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: ldnull
ldnull <null>
stloc.1 <null>
leave.s IL_0088: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0088: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add.ovf <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
blt.s IL_0043: ldc.i4 2000
ldloc.0 <null>
brfalse IL_0197: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
brfalse.s IL_00BA: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
br.s IL_00D0: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
brfalse.s IL_00E8: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
br.s IL_00FE: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
brfalse.s IL_0111: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
br.s IL_0127: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_017C: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
brfalse.s IL_0146: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
br.s IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_0191: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void CachedHandleProvider::ReadCoreData(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
Module Name
AppXDeployment58.exe
Full Name
AppXDeployment58.exe
EntryPoint
System.Void CachedHandleProvider::Main()
Scope Name
AppXDeployment58.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AppXDeployment58
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
800
Main Method
System.Void CachedHandleProvider::Main()
Main IL Instruction Count
131
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0197: ret
ldloc.0 <null>
brtrue.s IL_0091: ldloc.0
ldloc.1 <null>
brfalse.s IL_002F: leave.s IL_003D
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_003D: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: ldnull
ldnull <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_008C: ldloc.2
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brfalse.s IL_0060: nop
leave.s IL_0091: ldloc.0
nop <null>
ldloc.1 <null>
brfalse.s IL_006A: leave.s IL_0078
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_0078: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: ldnull
ldnull <null>
stloc.1 <null>
leave.s IL_0088: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0088: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add.ovf <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
blt.s IL_0043: ldc.i4 2000
ldloc.0 <null>
brfalse IL_0197: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
brfalse.s IL_00BA: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
br.s IL_00D0: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
brfalse.s IL_00E8: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
br.s IL_00FE: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
brfalse.s IL_0111: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
br.s IL_0127: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_017C: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
brfalse.s IL_0146: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
br.s IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_0191: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void CachedHandleProvider::ReadCoreData(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
ea891174ee65d94398487735e48c7c2d
Overlay_7ecd8ad2.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
turbojpeg.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙