Malicious PE Executable analysis – 7a51aaa00567

PE Executable

MD5: f807cad961a8b128192e82f33c759de7

Size: 846.85 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

846.85 KB · 846,848 B

First seen

2025-07-24 09:30 · one year ago

Last seen

2025-07-24 09:30 · one year ago

Last analysis

2025-07-24 09:32 · one year ago

Hashes

MD5 f807cad961a8b128192e82f33c759de7 Sha1 094eaa457e0f24075679e2be5e5f620cc0217729 Sha256 7a51aaa00567b257a98f7c0324123d44a0e63af5529fbb498b09e485fa6ecc9b Sha384 8db6164221ccd2848547ebb87f1b18e93c98edb9ebd2d4c270842b9d747c525ee3c5de460378707ed29cc61a2d93a94c Sha512 01718ed9d84d6ef6c39bdc7e534362004ac5df92010188e4c8228b7c8b1e58e5cd471fa69bb57ea001a3486b10ba9452005e84da2e0393687cc3e27331773d8b SSDeep 12288:pfJ+o5DzwSyUkeDho0JMSUG8Ts5GzvPlsHT11p87k7WGxsy2eydFs+:pfIeDhohsGznlsJ7WG32dFs+ TLSH 0805E6017E44CE12F4091373C2EF4A4887B099916AA6E32B7DBA776E55123A73C4DDCB

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 4 files

EXEf807cad961a8b128192e82f33c759de7

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:1033

BIN.Net Resources

BINlraiTiJcIhEm4KWr9f.yabSlh6Vhpn4kTqTXG

BINs3VJEnvfl74YgIEEse.QdXts1bD7WeaX0yxdL

Name	Value
Module Name	AhbOK0pJbG5vmAkOFIawxb89sk
Full Name	AhbOK0pJbG5vmAkOFIawxb89sk
EntryPoint	System.Void yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::bCv4WQnQG9()
Scope Name	AhbOK0pJbG5vmAkOFIawxb89sk
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	46c1B07yCT3EYCAv1mF7PdUXUPvtijcgk0vM8P45oMi5
Assembly Version	1.0.0.7
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::bCv4WQnQG9()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void IMQfoe4UrLLUcmCWvaP.anxLsM4m5PEXF7ImrRE::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::wIx48OqccC callvirt System.Void dFAZcRkm0o6BjbFxBco.fE8IAckPt3tVJoi9cIL::ofoxZdhBJa() nop <null> ret <null>`
Module Name	AhbOK0pJbG5vmAkOFIawxb89sk
Full Name	AhbOK0pJbG5vmAkOFIawxb89sk
EntryPoint	System.Void yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::bCv4WQnQG9()
Scope Name	AhbOK0pJbG5vmAkOFIawxb89sk
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	46c1B07yCT3EYCAv1mF7PdUXUPvtijcgk0vM8P45oMi5
Assembly Version	1.0.0.7
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::bCv4WQnQG9()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void IMQfoe4UrLLUcmCWvaP.anxLsM4m5PEXF7ImrRE::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object yp0lrikMZuMLZ1JtlF4.fnKW5JkYFo206kLUdwU::wIx48OqccC callvirt System.Void dFAZcRkm0o6BjbFxBco.fE8IAckPt3tVJoi9cIL::ofoxZdhBJa() nop <null> ret <null>`

1 malicious · 4 files

EXEf807cad961a8b128192e82f33c759de7

Structure

BINResources

BIN.Net Resources

No malware configuration was found at this point.