Suspicious
Suspect

346da71ccec102706a06d02531730c32

PE Executable
MD5: 346da71ccec102706a06d02531730c32
Size: 675.33 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 346da71ccec102706a06d02531730c32
Sha1 b0a37893c944476dcd135417d5a908f9fc9d5072
Sha256 ec81c38ff89da4f91aff94a7ae635adef1e8a4eb07f6ee5eb3f1908e33fb1a19
Sha384 354f24b90c6635aa9ecc67c2b22d7f9207c2fab1284d6a8cf80df2193c3e05e30b18674b8e7a00d6dddd9e7cf716305d
Sha512 e44bdf0152d96bcd6a2ad3fbb7911ed56a12b9be2eb9d4cf1f3164be020d70b0bcf403c26f0f51a4d815bba699888ca7e42ab7341a7ce5f798eaaaaf48800392
SSDeep 12288:u6ACoHDHrVuKm6gSOC3DQ5HT0MhTkCQ5aj/:zA3Y6CCiT04TkCR
TLSH 31E41264299EED21D9D61BF504B0C7F25174DED9F833E313DBECACAB392A64129143A0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
346da71ccec102706a06d02531730c32
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PharmacyManager.Properties.Resources.resources
gr
[NBF]root.Data
kgbm
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
zQcZ.exe
Full Name
zQcZ.exe
EntryPoint
System.Void PharmacyManager.Program::Main()
Scope Name
zQcZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zQcZ
Assembly Version
8.4.6.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
96
Main Method
System.Void PharmacyManager.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PharmacyManager.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
zQcZ.exe
Full Name
zQcZ.exe
EntryPoint
System.Void PharmacyManager.Program::Main()
Scope Name
zQcZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zQcZ
Assembly Version
8.4.6.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
96
Main Method
System.Void PharmacyManager.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PharmacyManager.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
zQhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
346da71ccec102706a06d02531730c32
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PharmacyManager.Properties.Resources.resources
gr
[NBF]root.Data
kgbm
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
zQhuhuhuhu
346da71ccec102706a06d02531730c32
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙