Suspicious
Suspect

ea891174ee65d94398487735e48c7c2d

Share on LinkedIn
Print
PE Executable
MD5: ea891174ee65d94398487735e48c7c2d
Size: 1.63 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 ea891174ee65d94398487735e48c7c2d
Sha1 6b948cc8a2f0df1d73356c31babf9abb00400bd7
Sha256 61cebdb49a8a52bb4d282c873f1ead58ee6b0583d22adefda10cd3cfc2e3d1b4
Sha384 b9c6cc6b83ed3de1e99f5defbb842ace32a426dc7e045f2b375e0f0e31b9ee6bbb99ac15368723194deea3df21fa03e6
Sha512 845978de5d514f8d71fb94a96cfa87f0251390849c31090263308aac2639035fe88fbca552bb852fc50bda3319c27986428f60b6c52331d2f76d0e4b4525a545
SSDeep 49152:oaetjJJJ8DCY51O4mTPmUQxGWcDVtmGR3J8uR5xGJrjnGnweVGOK40Gin9tb8FDG:oHa
TLSH 557509322B7959A2F76F0E35CCA1E53143BB745F13F248BBB9602AC337116C1B909999
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
ea891174ee65d94398487735e48c7c2d
Overlay_7ecd8ad2.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
turbojpeg.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 3
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_7ecd8ad2.bin (1536 bytes)
Module Name
AppXDeployment58.exe
Full Name
AppXDeployment58.exe
EntryPoint
System.Void CachedHandleProvider::Main()
Scope Name
AppXDeployment58.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AppXDeployment58
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
800
Main Method
System.Void CachedHandleProvider::Main()
Main IL Instruction Count
131
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0197: ret
ldloc.0 <null>
brtrue.s IL_0091: ldloc.0
ldloc.1 <null>
brfalse.s IL_002F: leave.s IL_003D
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_003D: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: ldnull
ldnull <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_008C: ldloc.2
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brfalse.s IL_0060: nop
leave.s IL_0091: ldloc.0
nop <null>
ldloc.1 <null>
brfalse.s IL_006A: leave.s IL_0078
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_0078: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: ldnull
ldnull <null>
stloc.1 <null>
leave.s IL_0088: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0088: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add.ovf <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
blt.s IL_0043: ldc.i4 2000
ldloc.0 <null>
brfalse IL_0197: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
brfalse.s IL_00BA: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
br.s IL_00D0: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
brfalse.s IL_00E8: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
br.s IL_00FE: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
brfalse.s IL_0111: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
br.s IL_0127: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_017C: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
brfalse.s IL_0146: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
br.s IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_0191: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void CachedHandleProvider::ReadCoreData(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
Module Name
AppXDeployment58.exe
Full Name
AppXDeployment58.exe
EntryPoint
System.Void CachedHandleProvider::Main()
Scope Name
AppXDeployment58.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AppXDeployment58
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
800
Main Method
System.Void CachedHandleProvider::Main()
Main IL Instruction Count
131
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0197: ret
ldloc.0 <null>
brtrue.s IL_0091: ldloc.0
ldloc.1 <null>
brfalse.s IL_002F: leave.s IL_003D
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_003D: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: ldnull
ldnull <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_008C: ldloc.2
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.1 <null>
ldstr 97131a21-32ba-482a-86a5-f3c71cb92851
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brfalse.s IL_0060: nop
leave.s IL_0091: ldloc.0
nop <null>
ldloc.1 <null>
brfalse.s IL_006A: leave.s IL_0078
ldloc.1 <null>
call System.Void System.Threading.WaitHandle::Dispose()
leave.s IL_0078: ldnull
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: ldnull
ldnull <null>
stloc.1 <null>
leave.s IL_0088: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0088: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add.ovf <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
blt.s IL_0043: ldc.i4 2000
ldloc.0 <null>
brfalse IL_0197: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AC: ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
brfalse.s IL_00BA: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
br.s IL_00D0: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_cachedslot59>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
brfalse.s IL_00E8: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
br.s IL_00FE: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler CachedHandleProvider/<_Closure$__>__Impl::<_chunk24>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
brfalse.s IL_0111: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
br.s IL_0127: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> CachedHandleProvider/<_Closure$__>__Impl::<_rawentry50>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_017C: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
brfalse.s IL_0146: ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
br.s IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld CachedHandleProvider/<_Closure$__>__Impl CachedHandleProvider/<_Closure$__>__Impl::<_token33>k__BackingField
ldftn System.Void CachedHandleProvider/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart CachedHandleProvider/<_Closure$__>__Impl::<_rawhandle22>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_0191: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void CachedHandleProvider::ReadCoreData(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙