Suspicious
Suspect

3921125696fcd8bd4bc9c6fd0c056ed3

PE Executable
|
MD5: 3921125696fcd8bd4bc9c6fd0c056ed3
|
Size: 654.34 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
3921125696fcd8bd4bc9c6fd0c056ed3
Sha1
c21f9a10d3e8654c57fb8251f5e29b6055527150
Sha256
c135ff17529e49649818039a136ab8c597f1f77589cf8568dac950c657ba5a66
Sha384
5cfb573a0ff7aeb67152f4bf8d26c2702f0cdee7460d94da6fcb2cd628f28b2fa294411a1fe096ef290de14c9db5af29
Sha512
b08e8347b556cbf33d9496bdb3d312b803403a24e8732723782105c00a574cbc863a95a77cfaa6451c0cdc5d26a3d2e42b4441d2e9930eb59d50ee8464b49804
SSDeep
12288:GNavavyX4XL8wTq87XzNhhUTQUiCsNAkjZPjaWWE66lO1:8qoodIj2+RNXxjFZE
TLSH
EED4E0546BA9C605D9AA07B56830E2740774BF57B421E30E4BC9BCEF3CB6B804D467A3
File Structure
3921125696fcd8bd4bc9c6fd0c056ed3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CustomTips.Forms.MainForm.resources
CustomTips.Properties.Resources.resources
KR
[NBF]root.Data
XIPCt
[NBF]root.Data
[NBF]root.Data-preview.png
Informations
Name
 Value
Module Name

AHnXO.exe
Full Name

AHnXO.exe
EntryPoint

System.Void CustomTips.Program::Main()
Scope Name

AHnXO.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

AHnXO
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5
Total Strings

841
Main Method

System.Void CustomTips.Program::Main()
Main IL Instruction Count

40
Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) nop <null> ldnull <null> ldftn System.Void CustomTips.Program::Application_ThreadException(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void CustomTips.Program::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) nop <null> newobj System.Void CustomTips.Forms.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0070: ret stloc.0 <null> nop <null> ldstr Fatal error starting application: ldloc.0 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Application Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> nop <null> leave.s IL_0070: ret ret <null>
Artefacts
Name
 Value
PDB Path

AHnXO.pdb
3921125696fcd8bd4bc9c6fd0c056ed3 (654.34 KB)
File Structure
3921125696fcd8bd4bc9c6fd0c056ed3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CustomTips.Forms.MainForm.resources
CustomTips.Properties.Resources.resources
KR
[NBF]root.Data
XIPCt
[NBF]root.Data
[NBF]root.Data-preview.png
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
PDB Path

AHnXO.pdb

3921125696fcd8bd4bc9c6fd0c056ed3
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙