Suspicious
Suspect

6508402debef3fe6e447f7b160e50270

PE Executable
MD5: 6508402debef3fe6e447f7b160e50270
Size: 798.21 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 6508402debef3fe6e447f7b160e50270
Sha1 37c926e6110d860c568341cddf89b6cb4d729d06
Sha256 d7c64324b4f2b0aeccd0c12346788a52852bb31199174ec6f699a4f0dc4fee8a
Sha384 4fd28059c31c5ea187d942225b3ce1e2aa8f94cd3f286a3c1b95bec1ab7cae6e2c6fc34d2d535dce6d2abbb150933da9
Sha512 0bbbbae909a961bd5e26ca6e8b476745c9928a27ac97e20bb9e80b7dd491d29421f08e3b35ab4b91d60d970e1c9ca2f07ecb62a2286d7c8298a828a30ad2e9e8
SSDeep 12288:LAcRn9+QIV5nb0N1/ld94a2SSpp6nbxlqJRNrqLCRJKAlVIXyrQokkMerchg:LA+9+N5noN19d94Xdp21CUg0xyrQ6P
TLSH 8905CF9032AD8907E1B64AF04971E2B11BB67E5D766AC2CE9DC12CDF38F1F444A42B47
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
6508402debef3fe6e447f7b160e50270
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Assignment_2.ClassBooking.resources
bindingNavigatorAddNewItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorDeleteItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveFirstItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveLastItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveNextItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMovePreviousItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
memberBindingNavigatorSaveItem.Image
Assignment_2.MainMenu.resources
$this.Icon
[NBF]root.IconData
SHT
[NBF]root.Data
Assignment_2.Properties.Resources.resources
CityGymLogo
[NBF]root.Data
[NBF]root.Data-preview.png
ContactDetails
[NBF]root.Data
[NBF]root.Data-preview.png
Extras
[NBF]root.Data
[NBF]root.Data-preview.png
Help
[NBF]root.Data
[NBF]root.Data-preview.png
Membership Durationb
[NBF]root.Data
[NBF]root.Data-preview.png
Membership settings
[NBF]root.Data
[NBF]root.Data-preview.png
PaymentOptions
[NBF]root.Data
[NBF]root.Data-preview.png
PersonalGoals
[NBF]root.Data
[NBF]root.Data-preview.png
Special
[NBF]root.Data
[NBF]root.Data-preview.png
Start date
[NBF]root.Data
[NBF]root.Data-preview.png
lVYK
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\UsDglkAdnw\src\obj\Debug\yaoZ.pdb
Module Name
yaoZ.exe
Full Name
yaoZ.exe
EntryPoint
System.Void Assignment_2.Program::Main()
Scope Name
yaoZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yaoZ
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1482
Main Method
System.Void Assignment_2.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Assignment_2.MainMenu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
yaoZ.exe
Full Name
yaoZ.exe
EntryPoint
System.Void Assignment_2.Program::Main()
Scope Name
yaoZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yaoZ
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1482
Main Method
System.Void Assignment_2.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Assignment_2.MainMenu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
6508402debef3fe6e447f7b160e50270
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Assignment_2.ClassBooking.resources
bindingNavigatorAddNewItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorDeleteItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveFirstItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveLastItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMoveNextItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
bindingNavigatorMovePreviousItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
memberBindingNavigatorSaveItem.Image
Assignment_2.MainMenu.resources
$this.Icon
[NBF]root.IconData
SHT
[NBF]root.Data
Assignment_2.Properties.Resources.resources
CityGymLogo
[NBF]root.Data
[NBF]root.Data-preview.png
ContactDetails
[NBF]root.Data
[NBF]root.Data-preview.png
Extras
[NBF]root.Data
[NBF]root.Data-preview.png
Help
[NBF]root.Data
[NBF]root.Data-preview.png
Membership Durationb
[NBF]root.Data
[NBF]root.Data-preview.png
Membership settings
[NBF]root.Data
[NBF]root.Data-preview.png
PaymentOptions
[NBF]root.Data
[NBF]root.Data-preview.png
PersonalGoals
[NBF]root.Data
[NBF]root.Data-preview.png
Special
[NBF]root.Data
[NBF]root.Data-preview.png
Start date
[NBF]root.Data
[NBF]root.Data-preview.png
lVYK
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙