Suspicious
Suspect

01f8ae76c4d99dc8c01b00d7beb71657

Share on LinkedIn
Print
PE Executable
MD5: 01f8ae76c4d99dc8c01b00d7beb71657
Size: 747.01 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 01f8ae76c4d99dc8c01b00d7beb71657
Sha1 e3ca93a0db9993e214b4af79074fa59524a2c23f
Sha256 be09dbae32fa67700c6ebefff7f8e081b61efd7431cc7326093703a172f91530
Sha384 6c299afe8cfb08d64a2b2fccdd5e72bef3a0e76bec28a10ca59cec142fd3dddc61f70815dd6382ff93d9cf608639b7ef
Sha512 bd7afb50a127fcbd52ace2accf07afeeaa86ce3c6b1a0c166731f1f3b718dbde320dd0850789624f482b97b7277438ff38eeb42682aaf4a901efbb5518a33d08
SSDeep 12288:nx5aSUdxjUbWLpa12FOLbheSFBldXUwU7MvBeptEql4vquZSNYA44M2ER0/:Yji12FK9eS/EwyMvBQtE4YquZSNYA/ME
TLSH 24F4134CBF5AAF72C70F0B7754175748C0F24152B4B6F1A91DAD49E20F29788E18BA8B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
01f8ae76c4d99dc8c01b00d7beb71657
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
KhRw.exe
Full Name
KhRw.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
KhRw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
KhRw
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
27
Main IL 
ldsfld System.Byte[] SecureMode.ProfessionalForm53::Ⴓ
stloc.2 <null>
ldc.i4.3 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.ReliableForm18::Ⴅ()
ldc.i4 896
ldc.i4 936
call System.Void SecureMode.AdvancedForm20::Ⴄ(System.Int16,System.Int16)
ldc.i4.0 <null>
ldc.i4.s 116
ldc.i4.s 115
call System.Void SecureMode.EnhancedForm84::Ⴄ(System.Boolean,System.Char,System.Int16)
ldloc.2 <null>
ldc.i4 357
ldelem.u1 <null>
ldc.i4.s 31
sub <null>
stloc.1 <null>
br.s IL_0008: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Module Name
KhRw.exe
Full Name
KhRw.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
KhRw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
KhRw
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
2
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
27
Main IL 
ldsfld System.Byte[] SecureMode.ProfessionalForm53::Ⴓ
stloc.2 <null>
ldc.i4.3 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void SecureMode.ReliableForm18::Ⴅ()
ldc.i4 896
ldc.i4 936
call System.Void SecureMode.AdvancedForm20::Ⴄ(System.Int16,System.Int16)
ldc.i4.0 <null>
ldc.i4.s 116
ldc.i4.s 115
call System.Void SecureMode.EnhancedForm84::Ⴄ(System.Boolean,System.Char,System.Int16)
ldloc.2 <null>
ldc.i4 357
ldelem.u1 <null>
ldc.i4.s 31
sub <null>
stloc.1 <null>
br.s IL_0008: ldloc.1
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void SecureMode.Program::Main()
pop <null>
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙