Suspicious
Suspect

PE Executable
MD5: 136bf3c7e32b4f94d18241ba0c54105f
Size: 868.86 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 136bf3c7e32b4f94d18241ba0c54105f
Sha1 f5a9cf8b5017af50e1df67b225718262e559fbe6
Sha256 82453da04a3618eede4ec065f24f8e3e4e0c120072e659a6edf23eb7a7933a84
Sha384 f8ef4d0fd3ac8470e9dfcf2f35efb6a9855b0b0a09a659de7c7318a77bcad7bfcbab5155f38871be2af4a7e1bc36f1f7
Sha512 eab25660f17848c8ac98c074cdf7f84e759cd28c868088af8abc9d87649f72d91bdd55ab8f7f9e499f8b3fdf245804bfc567da57c501c23aad16e891dda6e56e
SSDeep 24576:0fAdNbcq7d48ezVrBI0+URkjNIgkeqlRQ:1cD86/f+Ue+gs
TLSH 0A05CF9C3254B59FC553CE728974ED70AA207DBA9307C20399D32D9FB91DA97CE102B2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
136bf3c7e32b4f94d18241ba0c54105f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
DSql
[NBF]root.Data
[NBF]root.Data-preview.png
IO
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
QzrE.exe
Full Name
QzrE.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
QzrE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
QzrE
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
48
Main IL 
nop <null>
call System.Void EventLogAnalyzer.Program::‪‫‫‏‏‌‌‏‭‮‮‌‌​‫‮‬‭‏‎​​‍‍‌‪‮()
nop <null>
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‎​‎​‬‌‏‍‬‌​‬‭‍​‎​​‪‫‮(System.Boolean)
nop <null>
nop <null>
ldc.i4 147561612
ldc.i4 1284146598
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005E: nop
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‌​‌‏‫‌‭‬‍‭‫‪‌‏‪‎​‏‬​‭​‭‫‌‎‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -1851438693
mul <null>
ldc.i4 -2037735433
xor <null>
br.s IL_0014: ldc.i4 1284146598
nop <null>
ldloc.1 <null>
ldc.i4 -217180052
mul <null>
ldc.i4 482863359
xor <null>
br.s IL_0014: ldc.i4 1284146598
nop <null>
leave.s IL_0089: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‮‎‫‬‭‍‌‪​‎‪‍‏‭‫‭‬‌‫‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‎‮‪‍‬‭‬‍‮​​‍‪‪‍‍‌‬‮​‭‪‌‬‌‫‎‌‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‪‍‫‬‎‭‌‏‫‎‍‭‮‫‍‮‌‏‬‌‍‫‭‭‍‫‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_0089: ret
ret <null>
Module Name
QzrE.exe
Full Name
QzrE.exe
EntryPoint
System.Void EventLogAnalyzer.Program::Main()
Scope Name
QzrE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
QzrE
Assembly Version
3.7.2.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void EventLogAnalyzer.Program::Main()
Main IL Instruction Count
48
Main IL 
nop <null>
call System.Void EventLogAnalyzer.Program::‪‫‫‏‏‌‌‏‭‮‮‌‌​‫‮‬‭‏‎​​‍‍‌‪‮()
nop <null>
ldc.i4.0 <null>
call System.Void EventLogAnalyzer.Program::‎​‎​‬‌‏‍‬‌​‬‭‍​‎​​‪‫‮(System.Boolean)
nop <null>
nop <null>
ldc.i4 147561612
ldc.i4 1284146598
xor <null>
dup <null>
stloc.1 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005E: nop
newobj System.Void EventLogAnalyzer.Forms.MainForm::.ctor()
call System.Void EventLogAnalyzer.Program::‌​‌‏‫‌‭‬‍‭‫‪‌‏‪‎​‏‬​‭​‭‫‌‎‮(System.Windows.Forms.Form)
ldloc.1 <null>
ldc.i4 -1851438693
mul <null>
ldc.i4 -2037735433
xor <null>
br.s IL_0014: ldc.i4 1284146598
nop <null>
ldloc.1 <null>
ldc.i4 -217180052
mul <null>
ldc.i4 482863359
xor <null>
br.s IL_0014: ldc.i4 1284146598
nop <null>
leave.s IL_0089: ret
stloc.0 <null>
nop <null>
ldstr An unexpected error occurred:


ldloc.0 <null>
call System.String EventLogAnalyzer.Program::‮‎‫‬‭‍‌‪​‎‪‍‏‭‫‭‬‌‫‫‮(System.Exception)
ldstr 

The application will now close.
call System.String EventLogAnalyzer.Program::‎‮‪‍‬‭‬‍‮​​‍‪‪‍‍‌‬‮​‭‪‌‬‌‫‎‌‮(System.String,System.String,System.String)
ldstr Critical Error
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult EventLogAnalyzer.Program::‪‍‫‬‎‭‌‏‫‎‍‭‮‫‍‮‌‏‬‌‍‫‭‭‍‫‮(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_0089: ret
ret <null>
136bf3c7e32b4f94d18241ba0c54105f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EventLogAnalyzer.Forms.MainForm.resources
EventLogAnalyzer.Properties.Resources.resources
DSql
[NBF]root.Data
[NBF]root.Data-preview.png
IO
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙