Suspicious
Suspect

PE Executable
MD5: 306e75fcb82eeee4bff923a261af7001
Size: 889.34 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 306e75fcb82eeee4bff923a261af7001
Sha1 3d419d8e0121357959e26f923f5b5b789123b83a
Sha256 4156831dff69a42b6dfd9725ed18b812d9f3933e77d54f7f87b52b785054c9a0
Sha384 e316a04827685b0bcf92d1d76690c335b91625d220d836197f471952b4fd83f1ef2df419ac7d146ce7f2e8d98cdac31c
Sha512 93a2029e65bac4c8f6e6bb638d635e36088c12ae57a9aa9ebb970413acfd4750d2c5a86e933b4399046a6a84189242116cdcfd86c1112af6b183171ab956d6fd
SSDeep 24576:GPoooooigooonb3QNVXgkHOMKlHRWVN8uasoiDKzg78F5pZclll:moooooigooonb3QNVtu9xWVNd/8z9F5K
TLSH 6115F17176629D13D6B652F00CE4D2B893B90ECAB921D2C76ED62CDF3DF9B019A04187
306e75fcb82eeee4bff923a261af7001
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Hastane_Projesi.FrmBilgiDuzenle.resources
$this.Icon
[NBF]root.IconData
Hastane_Projesi.FrmDuyurular.resources
Hastane_Projesi.FrmGirisler.resources
Hastane_Projesi.FrmSekreterDetay.resources
Nerde
[NBF]root.Data
Hastane_Projesi.Properties.Resources.resources
rnUc
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\ASEaFOapPo\src\obj\Debug\Llte.pdb
Module Name
Llte.exe
Full Name
Llte.exe
EntryPoint
System.Void Hastane_Projesi.Program::Main()
Scope Name
Llte.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Llte
Assembly Version
5.6.5.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
464
Main Method
System.Void Hastane_Projesi.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Hastane_Projesi.FrmGirisler::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
306e75fcb82eeee4bff923a261af7001
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Hastane_Projesi.FrmBilgiDuzenle.resources
$this.Icon
[NBF]root.IconData
Hastane_Projesi.FrmDuyurular.resources
Hastane_Projesi.FrmGirisler.resources
Hastane_Projesi.FrmSekreterDetay.resources
Nerde
[NBF]root.Data
Hastane_Projesi.Properties.Resources.resources
rnUc
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙