Suspicious
Suspect

0f1d42cb6725d8194145cff1d3683634

Share on LinkedIn
Print
PE Executable
MD5: 0f1d42cb6725d8194145cff1d3683634
Size: 920.58 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 0f1d42cb6725d8194145cff1d3683634
Sha1 d9c19f966ff9cadfb515586114754d7ddf2381e7
Sha256 4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
Sha384 ab2b091c73bacfa378af930688e8a682a0e44da465fc9860ff9a16ce89c408c1de5dd30f3bc7dec97597a1de12d39eed
Sha512 3090fa461d46f561b52c0929458050c07091519c30f1a9a31b76c2031f384d5989dbc3183824f2ce9bcf36d03ba9830b78462aac7335b72f7083fbef4cdc938c
SSDeep 12288:WlQE+W8AQEUd6SZzpX8zmt/C7Ra3r40wChB94Ux5eq8sewIk0YPgHKf6sk+KDXeL:4QTYKX8L7IsMxd8eCYPNfD4z/93
TLSH 2C15D04432ABEC03D4724BB009E1D37087B96F95E521E3574FE66ED77A26BC26484B83
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0f1d42cb6725d8194145cff1d3683634
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lcZS.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TidalMill.Properties.Resources.resources
KL
[NBF]root.Data
QdZr
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
lcZS.exe
Full Name
lcZS.exe
EntryPoint
System.Void QC.sI::PU()
Scope Name
lcZS.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
lcZS
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
728
Main Method
System.Void QC.sI::PU()
Main IL Instruction Count
15
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_000B: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0017: call System.Void C8u.x8a::DHO()
call System.Void C8u.x8a::DHO()
br IL_0021: nop
nop <null>
newobj System.Void kM.Bu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0031: nop
nop <null>
ret <null>
Module Name
lcZS.exe
Full Name
lcZS.exe
EntryPoint
System.Void QC.sI::PU()
Scope Name
lcZS.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
lcZS
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
728
Main Method
System.Void QC.sI::PU()
Main IL Instruction Count
15
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_000B: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0017: call System.Void C8u.x8a::DHO()
call System.Void C8u.x8a::DHO()
br IL_0021: nop
nop <null>
newobj System.Void kM.Bu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0031: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙