Suspicious
Suspect

46ca2ca86cf7d396440eddc802eb2b1c

PE Executable
MD5: 46ca2ca86cf7d396440eddc802eb2b1c
Size: 802.3 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 46ca2ca86cf7d396440eddc802eb2b1c
Sha1 663cafa216434ba64947bfdd5f086341361e02a5
Sha256 eb94e07697701e5ab73cce951a41e42d8a7dec771934961045643031fc720962
Sha384 bdca020ca002301e2369324e42d0b028bfef7f3d2c93befc2b482a32bfa11ab09fe942a07950d46b5711ce95592e2882
Sha512 951883859353c611f6401f3c08d7cf4cdbd6ea42b318f3540f6295359ff502c71a046de551ad4a1a6ec5847f78ba8146a951b706be2db5c2ab3c1630b9e31585
SSDeep 12288:kMrXz6tFg3kJWynQJViOlDN5Wxh6NUUsWgJDx6mNyrv+Q+Il9lVESh:dz/k4ynGViOlJ5iidsC/v+Ql7lZ
TLSH FA05025132D9EB06C0B74BF50C70E3B513752E997522E30A8EE6ACDF7C3A702194A697
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
MarcarConsulta.marcaConsulta.resources
bindingNavigatorAddNewItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorDeleteItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveFirstItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveLastItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveNextItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMovePreviousItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
tableBindingNavigatorSaveItem.Image
Project1_Lagrange_Naydanov_I.MainForm.resources
$this.Icon
[NBF]root.IconData
WR
[NBF]root.Data
MarcarConsulta.menu.resources
MarcarConsulta.Properties.Resources.resources
GYBG
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\UqbyukkxFm\src\obj\Debug\aaJf.pdb
Module Name
aaJf.exe
Full Name
aaJf.exe
EntryPoint
System.Void MarcarConsulta.Program::Main()
Scope Name
aaJf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aaJf
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
676
Main Method
System.Void MarcarConsulta.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void MarcarConsulta.menu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
aaJf.exe
Full Name
aaJf.exe
EntryPoint
System.Void MarcarConsulta.Program::Main()
Scope Name
aaJf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aaJf
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
676
Main Method
System.Void MarcarConsulta.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void MarcarConsulta.menu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
MarcarConsulta.marcaConsulta.resources
bindingNavigatorAddNewItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorDeleteItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveFirstItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveLastItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveNextItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMovePreviousItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
tableBindingNavigatorSaveItem.Image
Project1_Lagrange_Naydanov_I.MainForm.resources
$this.Icon
[NBF]root.IconData
WR
[NBF]root.Data
MarcarConsulta.menu.resources
MarcarConsulta.Properties.Resources.resources
GYBG
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙