Suspicious
Suspect

224e9c8ab29528f95c9e5e555aa61d0c

PE Executable
MD5: 224e9c8ab29528f95c9e5e555aa61d0c
Size: 639.49 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 224e9c8ab29528f95c9e5e555aa61d0c
Sha1 5718230328e0cd82c85b2fe13f419db5df554b29
Sha256 c843271a0f12c16b4cd550813cdd542e7acfcb5db93c0ecb079200484268dfc0
Sha384 c18306621285d943b2a28c5141a477f226762cbdbd50b3d1a88b14e5a094790f49d8b372369eee8b010993b0fb9817cd
Sha512 e240204f9037db82274fb781a02750a9a9c4de4dc31d5f5cef8c9de5c2667110ef8e0ceb02f85003e03f8e23a964e8c50b4207d598c3f7eb07e028752c3e8840
SSDeep 12288:MHKA1v4WEC7lIP0tw+nmU+ma/5gNJX5gFrQyDLcc1u3f2QAnqSGsyMIotw6V:MHKAR4wh+ewGa/5OJX5gFLDwQEiXJyMX
TLSH 3AD412043ABDC71BD5F72BB81479E27413B8BC2EA965DB8A4EC45CEF7866B804110B47
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TextTools.Forms.MainForm.resources
TextTools.Properties.Resources.resources
Mars
[NBF]root.Data
zldm
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: xdUp.pdb
Module Name
xdUp.exe
Full Name
xdUp.exe
EntryPoint
System.Void TextTools.Program::Main()
Scope Name
xdUp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xdUp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
204
Main Method
System.Void TextTools.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void TextTools.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TextTools.Forms.MainForm.resources
TextTools.Properties.Resources.resources
Mars
[NBF]root.Data
zldm
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙