Deep Malware Analysis of fef6cb0ab73a8f719cb2bde9675a6c65 | md5: fef6cb0ab73a8f719cb2bde9675a6c65 | .Net | PE (Portable Executable) | SOS: 0.33 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	fef6cb0ab73a8f719cb2bde9675a6c65
Sha1	fd99aaf479a20a8e91b57308000334b9e9447bdc
Sha256	b6350738bfa77cac9f7d5fa6d37be84e5ae6cc48aed2baba6c78b88fe812834f
Sha384	8c39bf6c579a90a67d84739055bf61fa71e2d01499d30d054c6882dd184c9b6244e6b820e7d7b10830e03be3cb96baf4
Sha512	320d5ddedd9151fb62ed081858cd480c0c41eb1eeb9fcb6f43d93ee7f16abc28d750b5a6ab8edc87ed003674163c3e73382e5c91ae8b90069a55c9c907838037
SSDeep	24576:cfUNuA6gK9vNGQyzEzN2Vm/8OGzuzmbE9Yp1xMEYEIHz:6UggK91GQSGYVm/8OGxp1xM0+
TLSH	0A25F14423ADDA16D1E21BF00A70D3B41BB89E45A521D3079FFABDEFB93A7446904363

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Module Name	hFQh.exe
Full Name	hFQh.exe
EntryPoint	System.Void Services.Program::Main()
Scope Name	hFQh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	hFQh
Assembly Version	1.0.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	378
Main Method	System.Void Services.Program::Main()
Main IL Instruction Count	20
Main IL	`nop <null> newobj System.Void Services.Form1::.ctor() stloc.0 <null> ldc.i4.5 <null> newobj System.Void Services.ProcessManager::.ctor(System.Int32) stloc.1 <null> nop <null> ldloc.0 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0025: ret stloc.2 <null> nop <null> ldloc.1 <null> callvirt System.Void Services.ProcessManager::StopAllServicesAsync() nop <null> nop <null> leave.s IL_0025: ret ret <null>`
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\Users\Administrator\Desktop\Client\Temp\BWdDIZYXKi\src\obj\Debug\hFQh.pdb