Suspicious
Suspect

PE Executable
MD5: fac72ff49a7b66430a8a6e87ee7ad5c0
Size: 793.09 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 fac72ff49a7b66430a8a6e87ee7ad5c0
Sha1 327511505be7f1b87831f1ab1b14511004182735
Sha256 b5530271f10e05e1bf2a67b4d89344c90d6ad746d1c78bf0cf75d9755a9f2ae5
Sha384 6f756c9365625dcbdd9161d4a162a2117ccfd33626e4d595e32cbbd81776020a81d11788935fd864ec9c497a9618aa1e
Sha512 87385de73834e93fb17104613b70733bd01263fa2d18ec891ded8dfaa1138070e2a22193cd20f7108a90339c1c65ee8bb7282754a7b2bc6a97cfa799c197a0f4
SSDeep 12288:0EOwsR+DvFRGyWseUeDRei+7U0RKvgrx+VJmeQNzuD:uwzRGdDu1r4/meQN
TLSH 6EF45BCC96E5F511D13FB2B42F39A61043F66EAF19A6DA482AC290C77F39A014E507D3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
fac72ff49a7b66430a8a6e87ee7ad5c0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Navgolsandor.105982340.png
5dpLiJo3Qf4dn.7KqbSof9nE.resources
84cb91deeee5c5.Resources.resources
30977d000
[NBF]root.Data
30977d001
[NBF]root.Data
30977d002
[NBF]root.Data
30977d003
[NBF]root.Data
30977d004
[NBF]root.Data
30977d005
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
5dpLiJo3Qf4dn
Full Name
5dpLiJo3Qf4dn
EntryPoint
System.Void 5dpLiJo3Qf4dn.9SjopfD3::Xc2bq3Fn()
Scope Name
5dpLiJo3Qf4dn
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5dpLiJo3Qf4dn
Assembly Version
6.18.25.269
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
4642
Main Method
System.Void 5dpLiJo3Qf4dn.9SjopfD3::Xc2bq3Fn()
Main IL Instruction Count
56
Main IL 
nop <null>
call System.Boolean System.Environment::get_UserInteractive()
ldc.i4.0 <null>
ceq <null>
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_000F: nop
br.s IL_0082: ret
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_003D: nop
call System.Boolean 5dpLiJo3Qf4dn.9SjopfD3::Eys68kRoxd0G2W()
pop <null>
nop <null>
nop <null>
call System.Boolean 5dpLiJo3Qf4dn.9SjopfD3::Gj0joC()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_004C: nop
br.s IL_0082: ret
nop <null>
nop <null>
call System.Void 5dpLiJo3Qf4dn.9SjopfD3::bWs9o0()
nop <null>
leave.s IL_007B: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void 5dpLiJo3Qf4dn.9SjopfD3::Es5zp0gQ(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007B: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
Module Name
5dpLiJo3Qf4dn
Full Name
5dpLiJo3Qf4dn
EntryPoint
System.Void 5dpLiJo3Qf4dn.9SjopfD3::Xc2bq3Fn()
Scope Name
5dpLiJo3Qf4dn
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5dpLiJo3Qf4dn
Assembly Version
6.18.25.269
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
4642
Main Method
System.Void 5dpLiJo3Qf4dn.9SjopfD3::Xc2bq3Fn()
Main IL Instruction Count
56
Main IL 
nop <null>
call System.Boolean System.Environment::get_UserInteractive()
ldc.i4.0 <null>
ceq <null>
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_000F: nop
br.s IL_0082: ret
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_003D: nop
call System.Boolean 5dpLiJo3Qf4dn.9SjopfD3::Eys68kRoxd0G2W()
pop <null>
nop <null>
nop <null>
call System.Boolean 5dpLiJo3Qf4dn.9SjopfD3::Gj0joC()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_004C: nop
br.s IL_0082: ret
nop <null>
nop <null>
call System.Void 5dpLiJo3Qf4dn.9SjopfD3::bWs9o0()
nop <null>
leave.s IL_007B: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
nop <null>
ldstr Application failed to start: 
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void 5dpLiJo3Qf4dn.9SjopfD3::Es5zp0gQ(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007B: nop
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
ret <null>
fac72ff49a7b66430a8a6e87ee7ad5c0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Navgolsandor.105982340.png
5dpLiJo3Qf4dn.7KqbSof9nE.resources
84cb91deeee5c5.Resources.resources
30977d000
[NBF]root.Data
30977d001
[NBF]root.Data
30977d002
[NBF]root.Data
30977d003
[NBF]root.Data
30977d004
[NBF]root.Data
30977d005
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙