Suspicious
Suspect

26071d673bb306eb902449736414be6e

PE Executable
MD5: 26071d673bb306eb902449736414be6e
Size: 1.09 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 26071d673bb306eb902449736414be6e
Sha1 a68c680af8e56d39a0bec601daf22fa632572424
Sha256 98f8ae8fa4845bf2d2211182a076027c29d1870cad5ddc150155cdbb72089f1d
Sha384 efad07977f784400a22f9db9081ec89df3a9c63bb52a832d50cd92e18f3d22e069e58ec21a07528bcdd2b9c77be88ea1
Sha512 aa802be757a4ad9257300c2862328b8ecbb92b1037cc939ecc2311761c2c741be92f7ee830537dacf884a4eb210fa76c575c923623899c6aaed53312526c7984
SSDeep 24576:yrAr2gM2WsXsT+coX251WiyZrjSH9y+qfXsK+pAYxNosj:VvJT89SA1urjixq4pZ
TLSH 98350218221ADD06C4921FB41971E7F82B695FE9E801D3139FEE7EEFF87AA512805341
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
26071d673bb306eb902449736414be6e
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
eSAQ
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2
Name Value
Module Name
ALlR.exe
Full Name
ALlR.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
ALlR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ALlR
Assembly Version
12.12.12.12
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\RVyHRlfdlk\src\obj\Debug\ALlR.pdb
Module Name
ALlR.exe
Full Name
ALlR.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
ALlR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ALlR
Assembly Version
12.12.12.12
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
26071d673bb306eb902449736414be6e
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
eSAQ
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙