Suspicious
Suspect

PE Executable
MD5: 33107e31785f866443e3168d5d9e69ad
Size: 753.66 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 33107e31785f866443e3168d5d9e69ad
Sha1 0d91da0186ab9d9b1159bd758a85b8f41e01a32f
Sha256 b37ff76776a38f2a0ded7ae2220a44c0dfcb92ed88f135bb3f4443ad8b98548a
Sha384 4f905ea6929faade0a40f683a394a13a3ed72d67737a5583d71143fd46a7d885094b5a63913c508c507237e72e3cf747
Sha512 c00daa37f2e1a6b71c92501851c7eebdbb4dd1d8e6e84dfcb95086a8a79664c54ab912d4060f7f79edb7b395bea363a8453176a11b20e8fdcb78dece8dd88954
SSDeep 12288:lQ1/3plPNh04F5Ym/LqiPwsYjQkbvpFCs4OjlK9BjqBdUE5yK:eF5lPNhxHTqiPLk92rGKzjsf
TLSH 36F40115A639CE12C5960FB06722EEB013BA6D98F421E7435ED6BCDB7377B8010D1A4B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
33107e31785f866443e3168d5d9e69ad
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DamassaProject.fmrAdministrador.resources
DamassaProject.fmrListarUsuario.resources
$this.Icon
[NBF]root.IconData
MR
[NBF]root.Data
usuarioRepositoryBindingSource.TrayLocation
DamassaProject.fmrLogin.resources
pic_Imagem.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
pic_Logo.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
DamassaProject.fmrSplash.resources
pic_Image.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
DamassaProject.Properties.Resources.resources
UunG
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
uAkr.exe
Full Name
uAkr.exe
EntryPoint
System.Void DamassaProject.Program::Main()
Scope Name
uAkr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uAkr
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
230
Main Method
System.Void DamassaProject.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void DamassaProject.fmrListarUsuario::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
uAkr.exe
Full Name
uAkr.exe
EntryPoint
System.Void DamassaProject.Program::Main()
Scope Name
uAkr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uAkr
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
230
Main Method
System.Void DamassaProject.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void DamassaProject.fmrListarUsuario::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Embedded Resources UNKNWOWNsuspect
7huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
33107e31785f866443e3168d5d9e69ad
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DamassaProject.fmrAdministrador.resources
DamassaProject.fmrListarUsuario.resources
$this.Icon
[NBF]root.IconData
MR
[NBF]root.Data
usuarioRepositoryBindingSource.TrayLocation
DamassaProject.fmrLogin.resources
pic_Imagem.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
pic_Logo.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
DamassaProject.fmrSplash.resources
pic_Image.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
DamassaProject.Properties.Resources.resources
UunG
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
33107e31785f866443e3168d5d9e69ad
Embedded Resources UNKNWOWNsuspect
7huhuhuhu
33107e31785f866443e3168d5d9e69ad
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
33107e31785f866443e3168d5d9e69ad
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙