Suspicious
Suspect

PE Executable
MD5: 289658dc66acad196e3ea40b1cb71b94
Size: 7.11 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 289658dc66acad196e3ea40b1cb71b94
Sha1 eebe1ac269745edcf821021c824f84d51a5068e1
Sha256 287b8d3a5d0326958711e0802dbc5dc3ad7df0ee4c22ffafa7a95d3fd416f9fd
Sha384 66dd4bea8a696ba0ba645b361fefa2394e3964050dc87a23deb97e6ec328f21895fc074d198465f9a19e2c58c4112c61
Sha512 b0020cd5baa43597e6665ec49a88ff41967cd3319caf26c4f55b424a8832b52256017020948e18cd7b872ce288c6ae52b29bef36dade241436b1f66885ef0fc2
SSDeep 196608:s8d+s3lZaRbLz711DHRS7bkgjVh9M/TFsExDaJ:Xd+graRb3711LRAhhsTWExDe
TLSH 2466335813155900D2DECF3E914B50EE142A6699E8B5F0BBCC6EEC813E64B54FACEE31
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
289658dc66acad196e3ea40b1cb71b94
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
xntQ.exe
Full Name
xntQ.exe
EntryPoint
System.Void HabitTracker.Program::Main()
Scope Name
xntQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xntQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
2
Main Method
System.Void HabitTracker.Program::Main()
Main IL Instruction Count
21
Main IL 
ldc.i4.3 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void HabitTracker.HabitTracker::Ⴗ()
ldc.i4 612
ldc.i4 540
call System.Void <PrivateImplementationDetails>::Ⴅ(System.Char,System.Char)
ldc.i4.0 <null>
ldc.i4 417
ldc.i4 492
call System.Void <PrivateImplementationDetails>::Ⴜ(System.Boolean,System.Int16,System.Int32)
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void HabitTracker.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void HabitTracker.Program::Main()
pop <null>
ret <null>
Module Name
xntQ.exe
Full Name
xntQ.exe
EntryPoint
System.Void HabitTracker.Program::Main()
Scope Name
xntQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xntQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
2
Main Method
System.Void HabitTracker.Program::Main()
Main IL Instruction Count
21
Main IL 
ldc.i4.3 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void HabitTracker.HabitTracker::Ⴗ()
ldc.i4 612
ldc.i4 540
call System.Void <PrivateImplementationDetails>::Ⴅ(System.Char,System.Char)
ldc.i4.0 <null>
ldc.i4 417
ldc.i4 492
call System.Void <PrivateImplementationDetails>::Ⴜ(System.Boolean,System.Int16,System.Int32)
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_0002: ldloc.1
newobj System.Void HabitTracker.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
ldtoken System.Void HabitTracker.Program::Main()
pop <null>
ret <null>
289658dc66acad196e3ea40b1cb71b94
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙