Suspicious
Suspect

0e49acb8d2e8bef06db4808f606b9496

PE Executable
|
MD5: 0e49acb8d2e8bef06db4808f606b9496
|
Size: 645.12 KB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
0e49acb8d2e8bef06db4808f606b9496
Sha1
ecd9fe5a0200e3bd48887b13eb8576cb23b59235
Sha256
963acdd20e2dda21dbfacdf467ea6603eac39c2628d83a747a936980b2b4e4bd
Sha384
fd7d3c6267b60ca4421f8ceea6a22fa7f12d8d933127cd1f44c21b1f37ad56b014ddfe3223424d49cd35644c2ff240d4
Sha512
24367f897beb696ac8cf6a4d2d253a5ca5d2f0c425f01e865897b2fab39888eb35788b34a626c939a072d877f8a34248562ec98416460257e7601d6a5603ad24
SSDeep
12288:aNRZkDwq/olTei+bWIVJE8sN3MitCBBwv3MaDVcEkkejb:cEfAxebJm8isOLDWEkkejb
TLSH
F4D41258B679C813D4A64BF21E28D23513FA0ECEA502C3C29FDA5EDFB4E5B105A51B43

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SectorRepair.MainForm.resources
SectorRepair.Properties.Resources.resources
fsks
[NBF]root.Data
[NBF]root.Data-preview.png
xsh
[NBF]root.Data
Informations
Name
Value
Module Name

wQrh.exe

Full Name

wQrh.exe

EntryPoint

System.Void SectorRepair.Program::Main()

Scope Name

wQrh.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

wQrh

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

320

Main Method

System.Void SectorRepair.Program::Main()

Main IL Instruction Count

7

Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void SectorRepair.Program::InitializeApplication() newobj System.Void SectorRepair.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

Module Name

wQrh.exe

Full Name

wQrh.exe

EntryPoint

System.Void SectorRepair.Program::Main()

Scope Name

wQrh.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

wQrh

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

320

Main Method

System.Void SectorRepair.Program::Main()

Main IL Instruction Count

7

Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void SectorRepair.Program::InitializeApplication() newobj System.Void SectorRepair.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

Artefacts
Name
Value
PDB Path

wQrh.pdb

0e49acb8d2e8bef06db4808f606b9496 (645.12 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙