Suspicious
Suspect

PE Executable
MD5: 593be06b9a360a2b5bddc8fcd0da2550
Size: 763.9 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 593be06b9a360a2b5bddc8fcd0da2550
Sha1 133b39db56c7535efa9382c171234d3d657b27d3
Sha256 20956193bf71a732ca34708c3c3989a7f5b7474f03b679dc9a38e69a1dfdbb53
Sha384 12e6713d555362f5cacb375cdc0504c451d7e4fdba88a9ebb5116fe673aca085ed37ff13e1c918c0cbafd4b820dfe534
Sha512 995564608132586c1b5d7cbae6ac842d9396a56c4b2202e7894c112cac33bac141dc2d42a469cffbd2ac10be00b626abf14d2c8533880605b6b28b92e047b6f2
SSDeep 12288:juOgQX3i3YNkJB48PIftiMYfiDk/5JQV0jbBW0:i0URHIkkRV0jbr
TLSH 16F4E1C17120499BE87E47F21412D8B547F25CEEE5B4D2892DEA3EA776F33230106A5B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
593be06b9a360a2b5bddc8fcd0da2550
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
aTuv.exe
Full Name
aTuv.exe
EntryPoint
System.Void StreamlinedHelper.Program::Main()
Scope Name
aTuv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aTuv
Assembly Version
7.0.0.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
560
Main Method
System.Void StreamlinedHelper.Program::Main()
Main IL Instruction Count
7
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void StreamlinedHelper.Program::InitializeApplication()
newobj System.Void StreamlinedHelper.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
aTuv.exe
Full Name
aTuv.exe
EntryPoint
System.Void StreamlinedHelper.Program::Main()
Scope Name
aTuv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aTuv
Assembly Version
7.0.0.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
560
Main Method
System.Void StreamlinedHelper.Program::Main()
Main IL Instruction Count
7
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void StreamlinedHelper.Program::InitializeApplication()
newobj System.Void StreamlinedHelper.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Embedded Resources UNKNWOWNsuspect
9huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
593be06b9a360a2b5bddc8fcd0da2550
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
9huhuhuhu
593be06b9a360a2b5bddc8fcd0da2550
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
593be06b9a360a2b5bddc8fcd0da2550
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙