Suspicious
Suspect

PE Executable
MD5: 0bfe23bcd09166f9d77427e155949a76
Size: 964.1 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 0bfe23bcd09166f9d77427e155949a76
Sha1 429d214bc1859a6fe626e7d0394eaf1deef8a49f
Sha256 9b8d72d1a03fbc62aceda0d7e071474fa88f81624ce6aed1fd77f4197cd96305
Sha384 6540802fc2490701fad0d89de6179f4fe961afb4c73078837e9156d0261c08eac68bf352aa57c04eaf676eddabda759d
Sha512 2b43496a0547c42babb6476b802bffe0502a23fdf10eaddc9318fadebd896b977eafe41984a5ad7cb36df6eb808010f32575f3952f7db88950e7a701e30119c4
SSDeep 24576:rguQ8Zqt1/9zUqCOweMb/dDtYJ6fmDyQ5CPNAUq/XUK25IR7ckBf:0uTZqt99pfVszYERQ0ikK28bB
TLSH 0D2512612689DE26D47B57F90031E2B063B9AE6EB011C318CFE9FDDF76A5B912464303
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0bfe23bcd09166f9d77427e155949a76
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GratitudeJournal.Form1.resources
GratitudeJournal.Properties.Resources.resources
Clear
[NBF]root.Data
_02
[NBF]root.Data
[NBF]root.Data-preview.png
vvSURy
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
PartialTrustVisibilityLe
Full Name
PartialTrustVisibilityLe
EntryPoint
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Scope Name
PartialTrustVisibilityLe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uKsfps
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void EVENTINFOCL.NonGenericToGenericEnumera::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
PartialTrustVisibilityLe
Full Name
PartialTrustVisibilityLe
EntryPoint
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Scope Name
PartialTrustVisibilityLe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uKsfps
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void EVENTINFOCL.NonGenericToGenericEnumera::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
0bfe23bcd09166f9d77427e155949a76
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GratitudeJournal.Form1.resources
GratitudeJournal.Properties.Resources.resources
Clear
[NBF]root.Data
_02
[NBF]root.Data
[NBF]root.Data-preview.png
vvSURy
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙