Suspicious
Suspect

5dfaa756508354e2c5f20f11b12d0340

PE Executable
MD5: 5dfaa756508354e2c5f20f11b12d0340
Size: 800.77 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 5dfaa756508354e2c5f20f11b12d0340
Sha1 da935dfbdbc12c68a977f9d47e0bb32d9cd964f6
Sha256 b8d639465f33fa8d4dd8ed11a6c2d5e4ce849c4a8f4acb0fc6b6b030163c4eb2
Sha384 bba477bf17ee9086d81164a05ff06b5dbd2d1b4ebba31914d993d55980661b76d03e0b9c8731a1e968aeb5dd72d4581b
Sha512 27ded9919fc9f73c3942f85e89cb5b06d27286a2802af40cdb04270eaaa3010aed307046b36cb197edd9eacee458c5ed5df84d10c85318ba0cef914b1a0decc4
SSDeep 24576:kWktkhIpKWWRMr0jlPLtXjC88MgN9Btr:kdlr0j/XunN9
TLSH A40512512616DF13C0B21BF44EB1C3B857AC5D9A7810D30B6EF9FDEB7D2272129806A2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5dfaa756508354e2c5f20f11b12d0340
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
Fdd
[NBF]root.Data
[NBF]root.Data-preview.png
KOp
[NBF]root.Data
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: AAc.pdb
Module Name
AAc.exe
Full Name
AAc.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
AAc.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AAc
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
AAc.exe
Full Name
AAc.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
AAc.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AAc
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
5dfaa756508354e2c5f20f11b12d0340
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
Fdd
[NBF]root.Data
[NBF]root.Data-preview.png
KOp
[NBF]root.Data
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙