Suspicious
Suspect

425f562bef72654adb18e8fe1ffc72f7

PE Executable
|
MD5: 425f562bef72654adb18e8fe1ffc72f7
|
Size: 732.67 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
425f562bef72654adb18e8fe1ffc72f7
Sha1
d332a8bd95c762705260ca8d4622d956fea8704c
Sha256
757c468152033ae927c61acf5899c6d2d62acccdf5dd01bd94220d4df4dae676
Sha384
d591cce28f19f4f3bc51b6c921740c3e4ab34ff1d2a609a434c8ecfb156a01dea2818c3197974d9f6d8c1e47a4810d21
Sha512
97f8c649559ff5595e5ae27c5c09d6551118565f5ed482b6f9936cb67b87e67e9d9e29594fe2790454f2c75680659b57f4544621f50cfe555f263ed995fd42c4
SSDeep
12288:hNavaH1v4IV8wTqaYQkkhwC0xeY2koEh5b6Nyf5ZNhb1PrTArfON+8O4f8XvgLtv:9Bz+drjzxeiJh5vBZ7pvMf5pkfzYe
TLSH
DAF4D065A799E888E54A2A305874D1300275BE8BE876C20FFEC47CDB78F23815997F53
File Structure
425f562bef72654adb18e8fe1ffc72f7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CustomTips.Forms.MainForm.resources
CustomTips.Properties.Resources.resources
KR
[NBF]root.Data
TPmLH
[NBF]root.Data
[NBF]root.Data-preview.png
Informations
Name
 Value
Module Name

QwTXr.exe
Full Name

QwTXr.exe
EntryPoint

System.Void CustomTips.Program::Main()
Scope Name

QwTXr.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

QwTXr
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5
Total Strings

841
Main Method

System.Void CustomTips.Program::Main()
Main IL Instruction Count

40
Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) nop <null> ldnull <null> ldftn System.Void CustomTips.Program::Application_ThreadException(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void CustomTips.Program::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) nop <null> newobj System.Void CustomTips.Forms.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0070: ret stloc.0 <null> nop <null> ldstr Fatal error starting application: ldloc.0 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) ldstr Application Error ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> nop <null> leave.s IL_0070: ret ret <null>
Artefacts
Name
 Value
PDB Path

QwTXr.pdb
425f562bef72654adb18e8fe1ffc72f7 (732.67 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙