Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 00868131ffd1b53108c151381e0c9132
Size: 587.78 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 00868131ffd1b53108c151381e0c9132
Sha1 9d07098e8fa4b5bfdea5f7fcdb9e254a8f2c609d
Sha256 6bfefb0f3b8a878aec69c3d830824c3bf7d5181ffd6d6e88dc4a8d793370c233
Sha384 50bb4677ae52184886c9f02aaada92d48a8f94bf2b78edd5b647c86342af5a535fb7866541a0b4339605ef4c1f9653f1
Sha512 825d58ff8176fa649ca68de661692bcee41ef421f815b10edee7a4911c61f5d5d79770066d84abda3c0919ab3d67938c75900b4a4aceb9e8fe8ea892ceeececa
SSDeep 12288:x8tSMDi77M2JXRQsezehA7TNhfFydK1iCEUanUVbMqmlbwN/D:xQSpc2jQtz6A7RhfFydTCEUu3ThwN/
TLSH 40C4128977B9CB21F0E5C7B11972E23223752C29F125D316DEEA6ECB3145B518F28B12
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
00868131ffd1b53108c151381e0c9132
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ScientificCalculator.Forms.GraphPlotterForm.resources
Scientific_Calc.Properties.Resources.resources
GNpQ
[NBF]root.Data
[NBF]root.Data-preview.png
PIP
[NBF]root.Data
t1
[NBF]root.Data
[NBF]root.Data-preview.png
t2
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
rEtH.exe
Full Name
rEtH.exe
EntryPoint
System.Void ScientificCalculator.Program::Main()
Scope Name
rEtH.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rEtH
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
380
Main Method
System.Void ScientificCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ScientificCalculator.Forms.MainCalculatorForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
rEtH.exe
Full Name
rEtH.exe
EntryPoint
System.Void ScientificCalculator.Program::Main()
Scope Name
rEtH.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rEtH
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
380
Main Method
System.Void ScientificCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ScientificCalculator.Forms.MainCalculatorForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
rEhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙