Suspicious
Suspect

PE Executable
MD5: 55964be96f066fccc14ed7d5d800acff
Size: 745.47 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 55964be96f066fccc14ed7d5d800acff
Sha1 8f43318e4cb3b51bc41035f2fe212c365d420749
Sha256 908ea4e10ff30ea0fb4dd724fdb19e1f9c491b443c90cf0957ed6216ff5d800e
Sha384 c085dbfad2bd251816b5ccbc57c0ff373666654102eda09a18f90943808f3205a1e141eaac6d6c05499310c417285fed
Sha512 f94cc3cf81b0b6f12142b0033135728d37f4f1a4a1bdb1bc47748ceb4fbfdc15036d88dc1fd969be430c958e508a62318b24011f542d4506e4e3bcddadf3eeb1
SSDeep 12288:iOuNiDiw3IlN4QoMeF9YS4ruYuKUje+s23jOuMCgPfhyM7OIKH:3uNiV4lN4QofZ4rExS+f7MVfhyM7PKH
TLSH 4BF423293754CD53D4B967B81B30EB3423B9AD8AE613E30A4FD9BCF77806B506941782
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
55964be96f066fccc14ed7d5d800acff
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NotepadPlus.Properties.Resources.resources
PIP
[NBF]root.Data
grass
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile_2
[NBF]root.Data
[NBF]root.Data-preview.png
t1
[NBF]root.Data
[NBF]root.Data-preview.png
xvaE
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
SklQ.exe
Full Name
SklQ.exe
EntryPoint
System.Void NotepadPlus.Program::Main(System.String[])
Scope Name
SklQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SklQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
203
Main Method
System.Void NotepadPlus.Program::Main(System.String[])
Main IL Instruction Count
52
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NotepadPlus.MainForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0060: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_005F: nop
nop <null>
nop <null>
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void NotepadPlus.MainForm::OpenFile(System.String)
nop <null>
nop <null>
leave.s IL_005E: nop
stloc.s ex
nop <null>
ldstr Error opening file: 
ldloc.s ex
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr NotepadPlus
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_005E: nop
nop <null>
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
SklQ.exe
Full Name
SklQ.exe
EntryPoint
System.Void NotepadPlus.Program::Main(System.String[])
Scope Name
SklQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SklQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
203
Main Method
System.Void NotepadPlus.Program::Main(System.String[])
Main IL Instruction Count
52
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NotepadPlus.MainForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0060: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_005F: nop
nop <null>
nop <null>
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void NotepadPlus.MainForm::OpenFile(System.String)
nop <null>
nop <null>
leave.s IL_005E: nop
stloc.s ex
nop <null>
ldstr Error opening file: 
ldloc.s ex
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr NotepadPlus
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_005E: nop
nop <null>
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
Skhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
55964be96f066fccc14ed7d5d800acff
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NotepadPlus.Properties.Resources.resources
PIP
[NBF]root.Data
grass
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile_2
[NBF]root.Data
[NBF]root.Data-preview.png
t1
[NBF]root.Data
[NBF]root.Data-preview.png
xvaE
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
Skhuhuhuhu
55964be96f066fccc14ed7d5d800acff
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙