Suspicious
Suspect

PE Executable
MD5: 25a9197c370a42ab03e3d26c515f1b5d
Size: 959.49 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 25a9197c370a42ab03e3d26c515f1b5d
Sha1 437d3bb69faa5f84e42e39a0fb5629edd6123556
Sha256 413f7d00e03f5dd9362c7d2c8e5ee71de5379343db934bc87a4dd15e251b488c
Sha384 40b0772fec961063ee403a483abb6dde4f902fdeae770706b3483080df0ab8d0a4198b240ab7d7e849b215dafd842205
Sha512 519c82fbb567fe4231114723639d97b24c3f1f105c164bd2f2a3df276b9005a27d15eedce35fa1a9873369ae0529af5eb90671ae470e1c9c62bd7a3ab24824e7
SSDeep 12288:7L00OWcTgtc1HBFEuMANxF/mkffxmV8S4nORYQxQn7TnY3JcPT1nqr80mW0:70dHF/mOmVUnOM7U3yxU804
TLSH BF1501D1B210C699FDB613706C22CAB51A672CFEE5B1D20925FDBD633AF7362000965B
25a9197c370a42ab03e3d26c515f1b5d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
LoremMaker.Forms.MainForm.resources
LoremMaker.Properties.Resources.resources
KS
[NBF]root.Data
uaGC
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: jArk.pdb
Module Name
jArk.exe
Full Name
jArk.exe
EntryPoint
System.Void LoremMaker.Program::Main()
Scope Name
jArk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
jArk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
350
Main Method
System.Void LoremMaker.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void LoremMaker.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
25a9197c370a42ab03e3d26c515f1b5d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
LoremMaker.Forms.MainForm.resources
LoremMaker.Properties.Resources.resources
KS
[NBF]root.Data
uaGC
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙