Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 0bfe23bcd09166f9d77427e155949a76
Size: 964.1 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 0bfe23bcd09166f9d77427e155949a76
Sha1 429d214bc1859a6fe626e7d0394eaf1deef8a49f
Sha256 9b8d72d1a03fbc62aceda0d7e071474fa88f81624ce6aed1fd77f4197cd96305
Sha384 6540802fc2490701fad0d89de6179f4fe961afb4c73078837e9156d0261c08eac68bf352aa57c04eaf676eddabda759d
Sha512 2b43496a0547c42babb6476b802bffe0502a23fdf10eaddc9318fadebd896b977eafe41984a5ad7cb36df6eb808010f32575f3952f7db88950e7a701e30119c4
SSDeep 24576:rguQ8Zqt1/9zUqCOweMb/dDtYJ6fmDyQ5CPNAUq/XUK25IR7ckBf:0uTZqt99pfVszYERQ0ikK28bB
TLSH 0D2512612689DE26D47B57F90031E2B063B9AE6EB011C318CFE9FDDF76A5B912464303
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0bfe23bcd09166f9d77427e155949a76
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GratitudeJournal.Form1.resources
GratitudeJournal.Properties.Resources.resources
Clear
[NBF]root.Data
_02
[NBF]root.Data
[NBF]root.Data-preview.png
vvSURy
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
PartialTrustVisibilityLe
Full Name
PartialTrustVisibilityLe
EntryPoint
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Scope Name
PartialTrustVisibilityLe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uKsfps
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void EVENTINFOCL.NonGenericToGenericEnumera::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
PartialTrustVisibilityLe
Full Name
PartialTrustVisibilityLe
EntryPoint
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Scope Name
PartialTrustVisibilityLe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uKsfps
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void HMACS.PublisherIdentityPermissionAttrib::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void EVENTINFOCL.NonGenericToGenericEnumera::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙