Suspicious
Suspect

PE Executable
MD5: 60497893c56ce0803bd4701db92ad41e
Size: 524.8 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 60497893c56ce0803bd4701db92ad41e
Sha1 f82aef13ca956e99916fe1cea71a9611f146f587
Sha256 90fc5b8abe7025184179b0ecce4948baed241898ae625f3710ccc1cd92bcdc00
Sha384 af5538ee266f129f06846b0ede75ff11a675268d622e0f213feb2e4ddf44c31dd0adc962b79736c1e328909c63db2351
Sha512 326c219a2b7ddd0fc8aa2415abd3b43705fcc1b96550c1012a6926acaa3775f11713b6b3addd09536cd074a11732c61df16dcc8bf72d6bcacbf183184b276d90
SSDeep 12288:xOpxMrbZwMINh1bKF3G3IK8OX/3p5TggHFEpIxVbMiNgvmjm5/:sXMrbcGdIBX/3p5Tg/exVb6N/
TLSH A2B402A15199EE23C8D687F00A64D7F3037A9EDC9824C30796EEFCD7B90531526A63D2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
60497893c56ce0803bd4701db92ad41e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PuhonRM.Properties.Resources.resources
gsRT
vgx
PuhonRM.AddItem.resources
PuhonRM.ItemView.resources
btnAdd.Image
Name Value
Module Name
CmAq.exe
Full Name
CmAq.exe
EntryPoint
System.Void PuhonRM.Program::Main()
Scope Name
CmAq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CmAq
Assembly Version
1.6.2010.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
107
Main Method
System.Void PuhonRM.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PuhonRM.ItemView::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
CmAq.exe
Full Name
CmAq.exe
EntryPoint
System.Void PuhonRM.Program::Main()
Scope Name
CmAq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CmAq
Assembly Version
1.6.2010.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
107
Main Method
System.Void PuhonRM.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PuhonRM.ItemView::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
60497893c56ce0803bd4701db92ad41e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PuhonRM.Properties.Resources.resources
gsRT
vgx
PuhonRM.AddItem.resources
PuhonRM.ItemView.resources
btnAdd.Image
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
60497893c56ce0803bd4701db92ad41e
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
60497893c56ce0803bd4701db92ad41e
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙