Suspicious
Suspect

373024184789ac365d08a68045a0de4f

Share on LinkedIn
Print
PE Executable
MD5: 373024184789ac365d08a68045a0de4f
Size: 4.62 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 373024184789ac365d08a68045a0de4f
Sha1 dff0fd4aa0420ae9bf9075725783bfed4acaefca
Sha256 f645b0d2a7e3e35d416f872354de833f73bafda3edcdf208176bcb172cb5eeae
Sha384 9d4ac018fd31170ebba5ceb430d16b3d9f6b6f6ab7d62a8a41ed3457150028c92a1eb1f2b814d4292364041264453729
Sha512 838405fac17e2ae19233f67111498bd73797c5ced3ebd0b595fab03a1ef7754b51aea9900bd1b22834f9cc4e8e99bdd1fc24968cd44d3e1bc4c603c8530472d1
SSDeep 98304:vHvHQHSjOsQK6FuCVpYY/WqmjiJ8kNwiVc:vmLsQJF5TpOqEinNB6
TLSH D22633413BF85E76D97E8B3678B52792E3BB7966E236E76C0D40D4C84660BD4C806323
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
373024184789ac365d08a68045a0de4f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
arte.adao.jpg
arte.adao.jpg-preview.png
arte.arnolfini.jpg
arte.arnolfini.jpg.exif
arte.arnolfini.jpg-preview.png
arte.caipira.jpg
arte.caipira.jpg-preview.png
arte.estrelada.jpg
arte.estrelada.jpg-preview.png
arte.grito.jpg
arte.grito.jpg.exif
arte.grito.jpg-preview.png
arte.independencia.jpg
arte.independencia.jpg-preview.png
arte.liberdade.jpg
arte.liberdade.jpg-preview.png
arte.monalisa.jpg
arte.monalisa.jpg-preview.png
arte.napoleao.jpg
arte.napoleao.jpg-preview.png
arte.onda.jpg
arte.onda.jpg.exif
arte.onda.jpg-preview.png
arte.perola.jpg
arte.vangogh.jpg
arte.vangogh.jpg-preview.png
arte.venus.jpg
arte.venus.jpg-preview.png
arte.viajante.jpg
arte.viajante.jpg-preview.png
arte.whistler.jpg
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2
Name Value
Module Name
GansoDesktop.exe
Full Name
GansoDesktop.exe
EntryPoint
System.Int32 Program::Main(System.String[])
Scope Name
GansoDesktop.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GansoDesktop
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Total Strings
517
Main Method
System.Int32 Program::Main(System.String[])
Main IL Instruction Count
32
Main IL 
call System.Boolean Native::SetProcessDPIAware()
pop <null>
ldc.i4.1 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldarg.0 <null>
call System.Int32 Program::Run(System.String[])
stloc.1 <null>
leave.s IL_004F: ldloc.1
stloc.0 <null>
call System.String Program::get_Dir()
ldstr error.log
call System.String System.IO.Path::Combine(System.String,System.String)
ldloc.0 <null>
callvirt System.String System.Object::ToString()
call System.Void System.IO.File::WriteAllText(System.String,System.String)
leave.s IL_0035: ldarg.0
pop <null>
leave.s IL_0035: ldarg.0
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_004B: ldc.i4.1
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
ldstr Ganso de Desktop: erro
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldc.i4.1 <null>
stloc.1 <null>
leave.s IL_004F: ldloc.1
ldloc.1 <null>
ret <null>
Module Name
GansoDesktop.exe
Full Name
GansoDesktop.exe
EntryPoint
System.Int32 Program::Main(System.String[])
Scope Name
GansoDesktop.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GansoDesktop
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
517
Main Method
System.Int32 Program::Main(System.String[])
Main IL Instruction Count
32
Main IL 
call System.Boolean Native::SetProcessDPIAware()
pop <null>
ldc.i4.1 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldarg.0 <null>
call System.Int32 Program::Run(System.String[])
stloc.1 <null>
leave.s IL_004F: ldloc.1
stloc.0 <null>
call System.String Program::get_Dir()
ldstr error.log
call System.String System.IO.Path::Combine(System.String,System.String)
ldloc.0 <null>
callvirt System.String System.Object::ToString()
call System.Void System.IO.File::WriteAllText(System.String,System.String)
leave.s IL_0035: ldarg.0
pop <null>
leave.s IL_0035: ldarg.0
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue.s IL_004B: ldc.i4.1
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
ldstr Ganso de Desktop: erro
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldc.i4.1 <null>
stloc.1 <null>
leave.s IL_004F: ldloc.1
ldloc.1 <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙