Suspicious
Suspect

1a7b7bc650f7f6e987f8b781c5339530

PE Executable
MD5: 1a7b7bc650f7f6e987f8b781c5339530
Size: 850.44 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1a7b7bc650f7f6e987f8b781c5339530
Sha1 02fd24a08f6309de61887fa5bb173cbea7b74959
Sha256 fba7995cbf66a769e14608c6c1c499704f2fb7fbcbeae67407476e97f983b8fa
Sha384 b536593bfab6f5bb5b38e7c6a7bc828e4f7f6e3c4c0c6b95d45fa781e1b1ba3b4fd0d8168d2afdccf6e343b05991685a
Sha512 338b2fb9a1096a3238261450c476498c5c6e37d95201cf15d393b231cff21284d01674abce0159e7f0fd9f4c8ed5af25fd74030068ed8b49e839537d1e8225a8
SSDeep 12288:Aznnf4igp2U1aIkqFtgL+x/u3tk3PTsZ121brpsYax+6SZYkR:Gnnf4iC2Sabqs+J3P4Z8psa
TLSH BF0501843245EA03D5A157F0996EE7FC63392F9AB920EE42BDD57CC73C3AB106086653
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Calculator_Project.Calculator.resources
$this.Icon
[NBF]root.IconData
greyder
[NBF]root.Data
Login_And_Register_Form.registerForm.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Login_And_Register_Form.frmLogin.resources
Login_And_Register_Form.Properties.Resources.resources
Bve
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0xCC400 size 13832 bytes
Info
PDB Path: fbf.pdb
Module Name
fbf.exe
Full Name
fbf.exe
EntryPoint
System.Void Login_And_Register_Form.Program::Main()
Scope Name
fbf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fbf
Assembly Version
6.3.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
174
Main Method
System.Void Login_And_Register_Form.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Login_And_Register_Form.registerForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Calculator_Project.Calculator.resources
$this.Icon
[NBF]root.IconData
greyder
[NBF]root.Data
Login_And_Register_Form.registerForm.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Login_And_Register_Form.frmLogin.resources
Login_And_Register_Form.Properties.Resources.resources
Bve
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙