494ff9dd49ad6adaf5311211433596a1

PE Executable

MD5: 494ff9dd49ad6adaf5311211433596a1

Size: 741.89 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	494ff9dd49ad6adaf5311211433596a1
Sha1	e80d0dde6967f2a367da42d3518a5123bce5cba9
Sha256	ebacd47d8d9c76fbc8e7f1c2d4768f5db3911ce8374ac2a704223c7c302b6998
Sha384	06234af223e8660cf5f3e2910f2903324187aea6019d74d167fda80c46eecee307a40d3315d2f4023f30968f9cdcf41e
Sha512	63c3f463c2b186789f36c42d8c34854afb6155d4d7b5932891fa558cb18ec8069ab631319cda93358f0e36b808f315b593de47ba7f1b78195fe20fb640c61aee
SSDeep	12288:nndOVNxOCeHmZWFdT89XOAM8LrQFUwcbq/wLOEjFUh+J9QdX5Vj4jb:UdOTfj4VYYFOwUEJ2dLj4jb
TLSH	06F4024936359C23D4AA4BF54960C27947B98DECA921E3C70FCA3DDB78E5B611981F03

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Hilh.exe
Full Name	Hilh.exe
EntryPoint	System.Void StreamlinedHelper.Program::Main()
Scope Name	Hilh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Hilh
Assembly Version	7.0.0.2
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	560
Main Method	System.Void StreamlinedHelper.Program::Main()
Main IL Instruction Count	7
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void StreamlinedHelper.Program::InitializeApplication() newobj System.Void StreamlinedHelper.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`
Module Name	Hilh.exe
Full Name	Hilh.exe
EntryPoint	System.Void StreamlinedHelper.Program::Main()
Scope Name	Hilh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Hilh
Assembly Version	7.0.0.2
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	560
Main Method	System.Void StreamlinedHelper.Program::Main()
Main IL Instruction Count	7
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void StreamlinedHelper.Program::InitializeApplication() newobj System.Void StreamlinedHelper.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`

Embedded Resources UNKNWOWNsuspect

9huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Embedded Resources UNKNWOWNsuspect

9huhuhuhu

494ff9dd49ad6adaf5311211433596a1

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

494ff9dd49ad6adaf5311211433596a1

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.