Suspicious
Suspect

PE Executable
MD5: 30fe21e4d87ece4b7da39abd7707d060
Size: 1.03 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 30fe21e4d87ece4b7da39abd7707d060
Sha1 623be1cced474328ade2a3c1afe5fcdac12034f0
Sha256 44d56ea314118afc4fa5fc409f4f1e4a8a232ff410de243c4fa14ada2365cae7
Sha384 fa7a7a6e91c50b65d480a4e47f4711d349ea308c85cbaff721a586cdf34446ac67ec5927ce44ca465c0221e884d3c4ba
Sha512 1d6456bab0624298c5c964fc18b6c3c5455b28b7a93fdd769d135c29a4668b8df82c338800ea7516c1e9cf1c3969c106028bbbb20c059a796934011893b067db
SSDeep 24576:7eWOffToEhDNYkisZ2Pxr7LCuRmtBVh0CyIZ6kr5p:jQLzYkJ2VLCugVVLZ/5
TLSH E72502546613CBC2C0E51BFC9CB2EF7442A74E887461CF799BDDBEAB3B262041D80665
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ticTacToe.Form1.resources
$this.Icon
[NBF]root.IconData
htta
[NBF]root.Data
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Core.Properties.Resources.resources
ABau
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: CBrj.pdb
Module Name
CBrj.exe
Full Name
CBrj.exe
EntryPoint
System.Void ticTacToe.Program::Main()
Scope Name
CBrj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CBrj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
155
Main Method
System.Void ticTacToe.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ticTacToe.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ticTacToe.Form1.resources
$this.Icon
[NBF]root.IconData
htta
[NBF]root.Data
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Core.Properties.Resources.resources
ABau
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙