Suspicious
Suspect

62d0bea481e0740830bc19ac179a59e4

PE Executable
|
MD5: 62d0bea481e0740830bc19ac179a59e4
|
Size: 893.44 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
62d0bea481e0740830bc19ac179a59e4
Sha1
873006ca6aa95c0c832edf74c4088118cc61d7f7
Sha256
dfb997172aa606be225589eda936fffafa037abc8ca25ee5c86c9faa0de13feb
Sha384
08c0cb930b8fdf33f8581afd920934f4dd548abc92981d8bfb2eeba08a557837cb294cfed0b9fad8b6d2c541ecab5a2e
Sha512
be675fb74b5b07d422b7de4a6d245983fa33ea85a3a09f1771c1877b54449e4b9cadb8632bc65634bc5fdaaaaf10710aaeb5dd07039c61cb1eb3a23aed9afa37
SSDeep
12288:HDkglD3oFLI3kdU+T2hiWnasoCEYpKYe+JzZBNAUO7xKqX:HD/lDysaU+T2hiz3CEYpKYBRZBa1
TLSH
6015CFB1F2B58459D49867714926D83022E71DBCECA0D30ED5DA7DAB79B3FC2089290F

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Zapsinaya_knizka_new.Form01.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Form1.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Properties.Resources.resources
AatX
[NBF]root.Data
[NBF]root.Data-preview.png
de
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: ?

Module Name

Wmrr.exe

Full Name

Wmrr.exe

EntryPoint

System.Void Zapsinaya_knizka_new.Program::Main()

Scope Name

Wmrr.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Wmrr

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

217

Main Method

System.Void Zapsinaya_knizka_new.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Zapsinaya_knizka_new.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

Wmrr.exe

Full Name

Wmrr.exe

EntryPoint

System.Void Zapsinaya_knizka_new.Program::Main()

Scope Name

Wmrr.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Wmrr

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

217

Main Method

System.Void Zapsinaya_knizka_new.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Zapsinaya_knizka_new.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

62d0bea481e0740830bc19ac179a59e4 (893.44 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Zapsinaya_knizka_new.Form01.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Form1.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Properties.Resources.resources
AatX
[NBF]root.Data
[NBF]root.Data-preview.png
de
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙