Suspicious
Suspect

fd226abad452b50c0fffcaf6b95eeb9a

Share on LinkedIn
Print
PE Executable
MD5: fd226abad452b50c0fffcaf6b95eeb9a
Size: 633.86 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 fd226abad452b50c0fffcaf6b95eeb9a
Sha1 0b960b68593bcb0b4a35d54bc9a62b21040d225a
Sha256 45f43faf81998970071bcdf231f14896b2de8aece176da37262405768cc70eef
Sha384 3886d51dc84f8c309961b2595d3526960c424dde5f706eeeda36c9de6df57c59ea1eca1fca3f0e12d403875f1c32c7ac
Sha512 51552060c526115237837c84539fffdac302c40fea84407438603d80ea1269ad045353c83b831554ac4935c50ff6f00ec90972cdc195ea554674effae1b992ae
SSDeep 12288:cswMKNPUQlVnNSfi2+VFintM9KNPUQlVnNSfi2+VFin:cssKQrnN2/+VFgtxKQrnN2/+VFg
TLSH B2D4AE691BA98D4BC3622B3C8DF0F338523D4BC53D16CB029EA258967E26F9E7D405C5
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
fd226abad452b50c0fffcaf6b95eeb9a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
ID:000B
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
launcher.ico
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
SWG Launcher.exe
Full Name
SWG Launcher.exe
EntryPoint
System.Void SwgLauncher.Program::Main()
Scope Name
SWG Launcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SWG Launcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
290
Main Method
System.Void SwgLauncher.Program::Main()
Main IL Instruction Count
37
Main IL 
call System.Boolean SwgLauncher.Program::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.Void SwgLauncher.Program::DontThrottleMe()
pop <null>
leave.s IL_000B: call System.Void SwgLauncher.Program::DontThrottleMe()
call System.Void SwgLauncher.Program::DontThrottleMe()
ldc.i4.8 <null>
call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32)
call System.Net.SecurityProtocolType System.Net.ServicePointManager::get_SecurityProtocol()
brfalse.s IL_002D: leave.s IL_0032
call System.Net.SecurityProtocolType System.Net.ServicePointManager::get_SecurityProtocol()
ldc.i4 3072
or <null>
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
leave.s IL_0032: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
pop <null>
leave.s IL_0032: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.IntPtr System.IntPtr::Zero
call System.Drawing.Graphics System.Drawing.Graphics::FromHwnd(System.IntPtr)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Single System.Drawing.Graphics::get_DpiX()
ldc.r4 96
div <null>
stsfld System.Single SwgLauncher.Theme::S
leave.s IL_0065: newobj System.Void SwgLauncher.MainForm::.ctor()
ldloc.0 <null>
brfalse.s IL_0064: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
newobj System.Void SwgLauncher.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
SWG Launcher.exe
Full Name
SWG Launcher.exe
EntryPoint
System.Void SwgLauncher.Program::Main()
Scope Name
SWG Launcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SWG Launcher
Assembly Version
1.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
290
Main Method
System.Void SwgLauncher.Program::Main()
Main IL Instruction Count
37
Main IL 
call System.Boolean SwgLauncher.Program::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.Void SwgLauncher.Program::DontThrottleMe()
pop <null>
leave.s IL_000B: call System.Void SwgLauncher.Program::DontThrottleMe()
call System.Void SwgLauncher.Program::DontThrottleMe()
ldc.i4.8 <null>
call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32)
call System.Net.SecurityProtocolType System.Net.ServicePointManager::get_SecurityProtocol()
brfalse.s IL_002D: leave.s IL_0032
call System.Net.SecurityProtocolType System.Net.ServicePointManager::get_SecurityProtocol()
ldc.i4 3072
or <null>
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
leave.s IL_0032: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
pop <null>
leave.s IL_0032: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.IntPtr System.IntPtr::Zero
call System.Drawing.Graphics System.Drawing.Graphics::FromHwnd(System.IntPtr)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Single System.Drawing.Graphics::get_DpiX()
ldc.r4 96
div <null>
stsfld System.Single SwgLauncher.Theme::S
leave.s IL_0065: newobj System.Void SwgLauncher.MainForm::.ctor()
ldloc.0 <null>
brfalse.s IL_0064: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
newobj System.Void SwgLauncher.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙