Malicious
Malicious

PE Executable
MD5: eb77ea1d8d65aeeb9ccdc4fef1680300
Size: 2.33 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 eb77ea1d8d65aeeb9ccdc4fef1680300
Sha1 4dc6114987b96c14641205d9f531858f74107b62
Sha256 a323ea7dbcedc67d2e78d657ba7cbbab7feaef3702a5fd3baf42738b8eb40692
Sha384 7100c7b194009a440352e873801064dfb9bf278646edb3b17681d9bd58e16f1fc63e59d6645788ca18c1cedf03fb209e
Sha512 ae8e29123980266eafbce50a33c973776162ee09bae04315f248ea23b7b43c6542569737a216eda4809d970cec11072bb98c062e35c538bc8f0cccf1cc1fd46f
SSDeep 49152:kIl8jrkaDlL36V+SF+5g/DulxBSpcF2BWPgJJiVamJ/4:3894VpE5ySlxlF2wP83
TLSH 68B5CF017E46CA11F4095233C2EF858847B2995166E6F32B7DBE376D95223973C0EACB
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
eb77ea1d8d65aeeb9ccdc4fef1680300
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
6oRj6MhDpTM1Wk7IDK.OQpZ8gKU1BbTAPnuqy
ippu15YUOlVoDrlcha.vy8yEgNf3ArZt1cImv
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
aneLkFbYJ6Mm3EjcXl
Full Name
aneLkFbYJ6Mm3EjcXl
EntryPoint
System.Void FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::nXWM8pvBpl()
Scope Name
aneLkFbYJ6Mm3EjcXl
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Iw20xfEe1SXz5ErFd1zXxCEJTIA8Ct0cz5xh
Assembly Version
5.7.6.6
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::nXWM8pvBpl()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void hDHsH9MufpccrGPZYuQ.FLBFrkMBwJGrF6HE9kU::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::XaVMIEHEcA
callvirt System.Void Dy87WHwBuIDxpQBJlc9.Y3RKIkwpl74brLKmBsP::qZMRE293Kl()
nop <null>
ret <null>
Module Name
aneLkFbYJ6Mm3EjcXl
Full Name
aneLkFbYJ6Mm3EjcXl
EntryPoint
System.Void FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::nXWM8pvBpl()
Scope Name
aneLkFbYJ6Mm3EjcXl
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Iw20xfEe1SXz5ErFd1zXxCEJTIA8Ct0cz5xh
Assembly Version
5.7.6.6
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::nXWM8pvBpl()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void hDHsH9MufpccrGPZYuQ.FLBFrkMBwJGrF6HE9kU::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object FXpc4Aw5rNm3LrQWgID.wtyQiowKdCtkjbwV7W6::XaVMIEHEcA
callvirt System.Void Dy87WHwBuIDxpQBJlc9.Y3RKIkwpl74brLKmBsP::qZMRE293Kl()
nop <null>
ret <null>
eb77ea1d8d65aeeb9ccdc4fef1680300
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
6oRj6MhDpTM1Wk7IDK.OQpZ8gKU1BbTAPnuqy
ippu15YUOlVoDrlcha.vy8yEgNf3ArZt1cImv
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙