Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 272fdaab71b40b842aba778b3b7fceb6
Size: 836.1 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 272fdaab71b40b842aba778b3b7fceb6
Sha1 fef76c44eeeaba68abe0c616a243f95c29a63a27
Sha256 5edd2f77052549775838fba8e2ae75d7a3e31a5d33861aab3df909d17ab3d45f
Sha384 fd382b71966aae0a0440b382176775b7a71372ef7c42af54191794f222a87c64ed1bf02a4b7ef065d83d5051882070f3
Sha512 98fc7cfb663d1a780b671e63d71f32a87ac14889ea8e53432d3e7108a978b41d09d6f5fc0de87e1dddfc84904fa669014e03695b7f76d00fee4a512fb13a4afd
SSDeep 12288:2kuIZ9pJDcaBiGCTT52P9Oi88vkfM+zuKXlchvvUqJQ4doM6eoXdl6iwUmc1T29E:AejgaBZATr4shXlcNUYzqjloUmc5x
TLSH 2B05CF7032AD9963C6A956F00520D43533B76ECF682AD2CA8DD67DCB7CE4BC01B95A43
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
272fdaab71b40b842aba778b3b7fceb6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Properties.Resources.resources
CHoO
[NBF]root.Data
[NBF]root.Data-preview.png
QLDTDD_FPT.StaffManagementForm.resources
$this.Icon
[NBF]root.IconData
kc
[NBF]root.Data
Name Value
Module Name
JreN.exe
Full Name
JreN.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
JreN.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JreN
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
975
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
JreN.exe
Full Name
JreN.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
JreN.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JreN
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
975
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
Jrhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙