Suspicious
Suspect

f197b2fa25645e07f94bea5bed69618c

PE Executable
MD5: f197b2fa25645e07f94bea5bed69618c
Size: 1.34 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.34 MB · 1,340,928 B
Hashes
MD5 f197b2fa25645e07f94bea5bed69618c Sha1 645fd480416c23576b0953509b3ba6788e0ae14f Sha256 f48d95d60766961eb4f706868eb7e1ba7f43168cb977fe341b1cdeb50381353e Sha384 feac280e4211972f459baa1d235a8e69a338d3e7ba17347d07e46ac277128af7ac1b90fc950d45521fb4663360245d8d Sha512 54286687910738ab984ac41f17df87e6deab8d89195c5c56954c2de2906d99316519934200ff5e9bc8ca1a7c21b72e25309f85b5a86b77251b239029c555f48e SSDeep 24576:DLPT3RYCwvelyh4B8YN6LFotG6UAKNS6MdU3tXGFxzaiTzTy4cLgwfiZ:DTN6eYCH2AUELdAMxzJTi4cLgwq TLSH F755E0AC7610F88FC857C9728AA4ED74A6106C7B9307D20391E72DEFB91CA57DE141E2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
9 files
EXEf197b2fa25645e07f94bea5bed69618c
Structure
BIN.Net Resources
BINFrostBreath.Properties.Resources.resources
BINJesu
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINVIN
DATA[NBF]root.Data
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
SbuD.exe
Full Name
SbuD.exe
EntryPoint
System.Void FrostBreath.Program::Main()
Scope Name
SbuD.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SbuD
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void FrostBreath.Program::Main()
Main IL Instruction Count
63
Main IL 
nop <null>
ldc.i4 -1338466956
ldc.i4 -1192122360
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.8 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00DD: ret
newobj System.Void FrostBreath.GameForm::.ctor()
stsfld FrostBreath.GameForm FrostBreath.Program::GameFormInstance
ldloc.0 <null>
ldc.i4 1850485828
mul <null>
ldc.i4 405997619
xor <null>
br.s IL_0006: ldc.i4 -1192122360
ldc.i4.0 <null>
call System.Void FrostBreath.Program::‪‬‫‍‎‍‌‫‮‮‏‎‮‫‎‭​‏‬‌‪‬‫‪‍​‫‌‮‮(System.Boolean)
nop <null>
ldloc.0 <null>
ldc.i4 -5243248
mul <null>
ldc.i4 346605611
xor <null>
br.s IL_0006: ldc.i4 -1192122360
newobj System.Void FrostBreath.PuzzleForm::.ctor()
stsfld FrostBreath.PuzzleForm FrostBreath.Program::PuzzleFormInstance
ldloc.0 <null>
ldc.i4 74348004
mul <null>
ldc.i4 1887594326
xor <null>
br.s IL_0006: ldc.i4 -1192122360
call System.Void FrostBreath.Program::‍‭‬‎‬‎‫​‪‪​‪‎​​​‎‮‏‭‍‍‎‮()
ldloc.0 <null>
ldc.i4 886161343
mul <null>
ldc.i4 173746957
xor <null>
br IL_0006: ldc.i4 -1192122360
nop <null>
ldloc.0 <null>
ldc.i4 780172352
mul <null>
ldc.i4 1292157590
xor <null>
br IL_0006: ldc.i4 -1192122360
newobj System.Void FrostBreath.TimerForm::.ctor()
stsfld FrostBreath.TimerForm FrostBreath.Program::TimerFormInstance
newobj System.Void FrostBreath.ScoreForm::.ctor()
stsfld FrostBreath.ScoreForm FrostBreath.Program::ScoreFormInstance
ldsfld FrostBreath.GameForm FrostBreath.Program::GameFormInstance
call System.Void FrostBreath.Program::‬‎‭‎‭‭‬‬‌‪‮‎‭‍‮‪‭‬‭‫‮‭‍‫‮(System.Windows.Forms.Form)
nop <null>
ldloc.0 <null>
ldc.i4 1300846437
mul <null>
ldc.i4 -294287801
xor <null>
br IL_0006: ldc.i4 -1192122360
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
SbuD.exe
Full Name
SbuD.exe
EntryPoint
System.Void FrostBreath.Program::Main()
Scope Name
SbuD.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SbuD
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void FrostBreath.Program::Main()
Main IL Instruction Count
63
Main IL 
nop <null>
ldc.i4 -1338466956
ldc.i4 -1192122360
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.8 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00DD: ret
newobj System.Void FrostBreath.GameForm::.ctor()
stsfld FrostBreath.GameForm FrostBreath.Program::GameFormInstance
ldloc.0 <null>
ldc.i4 1850485828
mul <null>
ldc.i4 405997619
xor <null>
br.s IL_0006: ldc.i4 -1192122360
ldc.i4.0 <null>
call System.Void FrostBreath.Program::‪‬‫‍‎‍‌‫‮‮‏‎‮‫‎‭​‏‬‌‪‬‫‪‍​‫‌‮‮(System.Boolean)
nop <null>
ldloc.0 <null>
ldc.i4 -5243248
mul <null>
ldc.i4 346605611
xor <null>
br.s IL_0006: ldc.i4 -1192122360
newobj System.Void FrostBreath.PuzzleForm::.ctor()
stsfld FrostBreath.PuzzleForm FrostBreath.Program::PuzzleFormInstance
ldloc.0 <null>
ldc.i4 74348004
mul <null>
ldc.i4 1887594326
xor <null>
br.s IL_0006: ldc.i4 -1192122360
call System.Void FrostBreath.Program::‍‭‬‎‬‎‫​‪‪​‪‎​​​‎‮‏‭‍‍‎‮()
ldloc.0 <null>
ldc.i4 886161343
mul <null>
ldc.i4 173746957
xor <null>
br IL_0006: ldc.i4 -1192122360
nop <null>
ldloc.0 <null>
ldc.i4 780172352
mul <null>
ldc.i4 1292157590
xor <null>
br IL_0006: ldc.i4 -1192122360
newobj System.Void FrostBreath.TimerForm::.ctor()
stsfld FrostBreath.TimerForm FrostBreath.Program::TimerFormInstance
newobj System.Void FrostBreath.ScoreForm::.ctor()
stsfld FrostBreath.ScoreForm FrostBreath.Program::ScoreFormInstance
ldsfld FrostBreath.GameForm FrostBreath.Program::GameFormInstance
call System.Void FrostBreath.Program::‬‎‭‎‭‭‬‬‌‪‮‎‭‍‮‪‭‬‭‫‮‭‍‫‮(System.Windows.Forms.Form)
nop <null>
ldloc.0 <null>
ldc.i4 1300846437
mul <null>
ldc.i4 -294287801
xor <null>
br IL_0006: ldc.i4 -1192122360
ret <null>
9 files
EXEf197b2fa25645e07f94bea5bed69618c
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙