Suspicious
Suspect

PE Executable
MD5: 3a651b6fcc14e6c127e202a5520ffd56
Size: 2.57 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3a651b6fcc14e6c127e202a5520ffd56
Sha1 fbd989763f795be94715baf2beb2da8975314891
Sha256 5f192f10cc75f3be973d6f3725fb0479f70f67fbb3412f9900a272730acf17b3
Sha384 e508c0192693d89cd34dece419e496ec3cd22cd98c34463e44c39bd911dd2ce4eacf86c05cc38e3f0ac3bae3e3c198d5
Sha512 fd4401a2d96ba41706dae599cd4094174751c6f7c6778c4f364fbd32c94103b306df830db35a11a8d4df9c841bf351237f176db39abd5fe399a8498e2ff725b1
SSDeep 49152:5lUBawZjERX6DrdvbFbOfd2C0zhVZmNbbEHdV1IhErRIlGY/M415B7+2URSMHAjp:TUsw1YX6/dv9OVZqxmhoolGY/M4zBCr6
TLSH 4DC523846799E320EC9887F51832DB7A173A9E4D7010C30A44FEEDDFBDABB503585686
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3a651b6fcc14e6c127e202a5520ffd56
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
Klmz.exe
Full Name
Klmz.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
Klmz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Klmz
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
247
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
Klmz.exe
Full Name
Klmz.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
Klmz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Klmz
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
247
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3a651b6fcc14e6c127e202a5520ffd56
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
3a651b6fcc14e6c127e202a5520ffd56
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
3a651b6fcc14e6c127e202a5520ffd56
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙