fa56dbddeeb7f8f00e079d96aaf53304

PE Executable

MD5: fa56dbddeeb7f8f00e079d96aaf53304

Size: 2.64 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	fa56dbddeeb7f8f00e079d96aaf53304
Sha1	25b8a4f25cb77d181399df336b3e19c2b5073301
Sha256	274ef738a146d4f472a1688c87affc57c64b0b79921a331c8e9261e27efc8b89
Sha384	9143f8f88ca16a84be7017cac5f4295d26ca2d3fd7577cdd59b80f4e7c082c21e05c015e3d73470eaa05ccc2da01537c
Sha512	8778c58f412d97796cf1f1e5714f98096d6ea9a143e47763422e54adaa5a4111c4398d0c3b087bea00ce854de85a2d74444c4688f2a168f911205fca3b87c81a
SSDeep	49152:F572oSL3A5lyoPVWbYILB/8dnfYME5q/RmCJKMo3EnP3ny:F572oSLN0VWbdwnQMSqZjKZMP3y
TLSH	55C52351B3A9DB52DDB217F80FB5E27063B62E0DA820D20A8ED57DD73532F141DA8623

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	esJN.exe
Full Name	esJN.exe
EntryPoint	System.Void CranberryBog.Program::Main()
Scope Name	esJN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	esJN
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	468
Main Method	System.Void CranberryBog.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void CranberryBog.Formlar.BataklikForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.