Suspicious
Suspect

3d22a007f0e5878fa47d9ded220b605d

Share on LinkedIn
Print
PE Executable
MD5: 3d22a007f0e5878fa47d9ded220b605d
Size: 803.84 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3d22a007f0e5878fa47d9ded220b605d
Sha1 cda5991df1a2598c1782c9eabb62755f83d6912b
Sha256 44c2f46e91c4b65b6f0c8385910af36a4255bba0fdd7bfccf2199e7a9faf19f7
Sha384 b57dabe489842490aa8afaddfc4ba202d6db3d2bebf4d9d649c98bd48e9a03a1840861221a88d4f10cab72653d6c5dd0
Sha512 2bfa2ba5a0691c5c6413909d8b802078375268a19f997cb70199c27c3ed33fbe81373beafeafcfe10c9719e3b82ce0f9f29518bfa192a1be5f02fad60ffcee73
SSDeep 24576:Wecof6GAELGxED05cahps/ydb3J4iOLoKm:1c2IE2b/8ilK
TLSH C805F1542359DE0BD4632BF40970E7B817B85E882526C3078EFBADEBB836B4564493D3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3d22a007f0e5878fa47d9ded220b605d
.Net Resources
Colombier.FormHistorique.resources
Colombier.Properties.Resources.resources
NR
[NBF]root.Data
bXOq
[NBF]root.Data
[NBF]root.Data-preview.png
logout
[NBF]root.Data
[NBF]root.Data-preview.png
nhanvien
[NBF]root.Data
[NBF]root.Data-preview.png
padlock
[NBF]root.Data
[NBF]root.Data-preview.png
pet
[NBF]root.Data
[NBF]root.Data-preview.png
thongke1
[NBF]root.Data
[NBF]root.Data-preview.png
thongke2
[NBF]root.Data
[NBF]root.Data-preview.png
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
xgBN.exe
Full Name
xgBN.exe
EntryPoint
System.Void Colombier.Program::Main()
Scope Name
xgBN.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xgBN
Assembly Version
2.50.20.50
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
239
Main Method
System.Void Colombier.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Colombier.FormAccueil::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
xgBN.exe
Full Name
xgBN.exe
EntryPoint
System.Void Colombier.Program::Main()
Scope Name
xgBN.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xgBN
Assembly Version
2.50.20.50
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
239
Main Method
System.Void Colombier.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Colombier.FormAccueil::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙