Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 3a651b6fcc14e6c127e202a5520ffd56
Size: 2.57 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3a651b6fcc14e6c127e202a5520ffd56
Sha1 fbd989763f795be94715baf2beb2da8975314891
Sha256 5f192f10cc75f3be973d6f3725fb0479f70f67fbb3412f9900a272730acf17b3
Sha384 e508c0192693d89cd34dece419e496ec3cd22cd98c34463e44c39bd911dd2ce4eacf86c05cc38e3f0ac3bae3e3c198d5
Sha512 fd4401a2d96ba41706dae599cd4094174751c6f7c6778c4f364fbd32c94103b306df830db35a11a8d4df9c841bf351237f176db39abd5fe399a8498e2ff725b1
SSDeep 49152:5lUBawZjERX6DrdvbFbOfd2C0zhVZmNbbEHdV1IhErRIlGY/M415B7+2URSMHAjp:TUsw1YX6/dv9OVZqxmhoolGY/M4zBCr6
TLSH 4DC523846799E320EC9887F51832DB7A173A9E4D7010C30A44FEEDDFBDABB503585686
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3a651b6fcc14e6c127e202a5520ffd56
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
Klmz.exe
Full Name
Klmz.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
Klmz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Klmz
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
247
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
Klmz.exe
Full Name
Klmz.exe
EntryPoint
System.Void SecureMode.Program::Main()
Scope Name
Klmz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Klmz
Assembly Version
1.6.1908.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
247
Main Method
System.Void SecureMode.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SecureMode.ProfessionalForm53::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙