Deep Malware Analysis of fbe0c284871a9c53527d17d76b127824 | md5: fbe0c284871a9c53527d17d76b127824 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.13

PE Executable

MD5: fbe0c284871a9c53527d17d76b127824

Size: 820.74 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	fbe0c284871a9c53527d17d76b127824
Sha1	6958eb8a8bd811df38d668f8f685ec4284569981
Sha256	4ff0882b1dfe25c7b1793da9754485d1f1a28e660934e8fec5b7aad2e5571502
Sha384	32ae9fe00beb7fd25eb5721cdee80cab8d11900f4d94107fa7a873f0cc61c918f7f4626e278637e228ff5c64828351d5
Sha512	8aaa8e551e10298233f0fc6cb26017b1648f2766a6eee02e541aaa4915b2d5dc8b7463016681b9f2c8674a66f16af0f0ac41c263c6b92c8556e97f750b980b2e
SSDeep	12288:sany0UxK+YPk7bDyO7Ig9tqZ2/C9BSPQgMbtnpw3jTLl2606MbdXAoYu99s4:Dy0Uuc7b+Pg9tg2/CnSibhpw3vBx
TLSH	5005CFAC3254B5EFC8A7C1B18A64DC75E6612CAB9317820790D758EFB90CA87DF141F2

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	DTCO.exe
Full Name	DTCO.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	DTCO.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DTCO
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁫⁫⁯‪‍‭‎⁫‫⁫⁭⁬‍‫⁬⁭⁭⁭⁪‌‏‬‪‭⁫‮‬⁬⁫⁭‮‮⁬‬‫⁪⁫‍‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::⁪⁬‌⁭‫⁪‫⁭‭‎⁭‍‌‎‮‭⁮‎‪⁬‫‮⁭‬⁭‎‪‭⁪‫‮‭⁯‍⁮‏‌‮‪‏‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‌‬‎‮⁭‪‭‬⁮‍⁫‫⁪‏‏⁪‮‎‎‍‮‌‬⁯‌⁮⁬‪‬‎⁪‏‌‬‎‮(System.Windows.Forms.Form) ret <null>
Module Name	DTCO.exe
Full Name	DTCO.exe
EntryPoint	System.Void ProjectWindowsForms.Program::Main()
Scope Name	DTCO.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DTCO
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	527
Main Method	System.Void ProjectWindowsForms.Program::Main()
Main IL Instruction Count	6
Main IL	call System.Void ProjectWindowsForms.Program::⁫⁫⁯‪‍‭‎⁫‫⁫⁭⁬‍‫⁬⁭⁭⁭⁪‌‏‬‪‭⁫‮‬⁬⁫⁭‮‮⁬‬‫⁪⁫‍‮() ldc.i4.0 <null> call System.Void ProjectWindowsForms.Program::⁪⁬‌⁭‫⁪‫⁭‭‎⁭‍‌‎‮‭⁮‎‪⁬‫‮⁭‬⁭‎‪‭⁪‫‮‭⁯‍⁮‏‌‮‪‏‮(System.Boolean) newobj System.Void ProjectWindowsForms.SmartForm13::.ctor() call System.Void ProjectWindowsForms.Program::‌‬‎‮⁭‪‭‬⁮‍⁫‫⁪‏‏⁪‮‎‎‍‮‌‬⁯‌⁮⁬‪‬‎⁪‏‌‬‎‮(System.Windows.Forms.Form) ret <null>

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

fbe0c284871a9c53527d17d76b127824

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

fbe0c284871a9c53527d17d76b127824

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.