Suspicious
Suspect

PE Executable
MD5: 3c4a6c27a6d45a3b46d9be7f95866797
Size: 521.74 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3c4a6c27a6d45a3b46d9be7f95866797
Sha1 a05b4ce99859e42e8aea6332cf428c176a983407
Sha256 36d699808361bcf77a1147c09dc4df6319b7bbf670814ab1f882bc2668fc11c0
Sha384 cbc9424acc1e1e7ab47e57865421796c797751d1e3179ae5fa49da8ed322b18dc4c879633981f437844044fee1913356
Sha512 4855c421f407412e16f32d68a31ecc1e1863d3a3c78b55c9950c22e33137bdb71e8faab73429b7b0d945df9d64f33aae7d3d8ab2a6beb873ed1415501059d607
SSDeep 12288:iwEvxP1oH+DF5dvHBgo2KxV+WMICks6LUDjYutL7FomD5MhKkR:uUex5d/BAIMICkZUJhDShJ
TLSH AFB412500729DA02EDD1AFB015B2D3B067F11EADA973D2078EDE8CEFB54271669143E2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3c4a6c27a6d45a3b46d9be7f95866797
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NumberLink.FormSelecteurNiveau.resources
NumberLink.Properties.Resources.resources
NH
[NBF]root.Data
qocEAS
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x7C000 size 13832 bytes
Info
PDB Path: dJomYv.pdb
Module Name
dJomYv.exe
Full Name
dJomYv.exe
EntryPoint
System.Void NumberLink.Program::Main()
Scope Name
dJomYv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dJomYv
Assembly Version
201.502.607.709
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
56
Main Method
System.Void NumberLink.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NumberLink.FormSelecteurNiveau::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
dJomYv.exe
Full Name
dJomYv.exe
EntryPoint
System.Void NumberLink.Program::Main()
Scope Name
dJomYv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dJomYv
Assembly Version
201.502.607.709
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
56
Main Method
System.Void NumberLink.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NumberLink.FormSelecteurNiveau::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
3c4a6c27a6d45a3b46d9be7f95866797
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NumberLink.FormSelecteurNiveau.resources
NumberLink.Properties.Resources.resources
NH
[NBF]root.Data
qocEAS
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙