3bb5d03fa5aa7873529b7343206e2002

PE Executable

MD5: 3bb5d03fa5aa7873529b7343206e2002

Size: 631.81 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	3bb5d03fa5aa7873529b7343206e2002
Sha1	38c9f89926de9fb35eb6c70991ef9f98e7bd9a05
Sha256	b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5
Sha384	9758bdbdb9ce666d8b07c0fa7d8dc27389c3e3ef42d0aa364309ac25be0056fe320f0841364650a7fe76ea35e986de97
Sha512	a256e4ea3866fe78b6c2f25f6d18f191ac2a4821f3a9f90984dc5614f6cb0c5dda9e4e971e31e0e1c443988faa09bc33cecf418451e07efbeab5402aea3b32d6
SSDeep	12288:7GE4FoxoBQhBGrvtzXhMoqYYwFhwJLM7awmzASWA0TBqmmoDFpNBHG:g/BQVoqrwFh+w7awmzASWAwz5pNB
TLSH	B9D4F0246618DA17C5B617B95270E23117BB8E5EB931D34A8EEDBCDB3B27B441E00393

STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name	Value
Module Name	LTCf.exe
Full Name	LTCf.exe
EntryPoint	System.Void QuanLyThuVienCaNhan.Program::Main()
Scope Name	LTCf.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	LTCf
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	428
Info	PE Detect: PeReader OK (file layout)
Main Method	System.Void QuanLyThuVienCaNhan.Program::Main()
Main IL Instruction Count	21
Main IL	nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void QuanLyThuVienCaNhan.GUI.frmLogin::.ctor() stloc.0 <null> ldloc.0 <null> callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog() ldc.i4.1 <null> ceq <null> stloc.1 <null> ldloc.1 <null> brfalse.s IL_002E: ret nop <null> newobj System.Void QuanLyThuVienCaNhan.GUI.frmMain::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> ret <null>
Info	PDB Path: C:\Users\Administrator\Desktop\Client\Temp\eLlnhawNHQ\src\obj\Debug\LTCf.pdb

No malware configuration was found at this point.

You must be signed in to view YARA rules.