Suspicious
Suspect

PE Executable
MD5: 68c3115909de6af13b312b691122d19a
Size: 716.29 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 68c3115909de6af13b312b691122d19a
Sha1 c55c3c80b8409ee5f6b45d4ba3365111c2bc5b17
Sha256 9128341eadbe23a479073756b46a420ec61725b60d8b7d68f428e997e30fc85f
Sha384 6fdaa021c6ffc01dc72b0c041a3417569725b2cdfac7c7b33c621a001e5813dd1e7d42c578be97b7ef1b2a64fbb8b0c2
Sha512 f0406ebd713566a58d596b2ffdce0f681a7bbb3748b2453ce67c45b990a1e913cfb25fe9f259d8023fdf0d3bb58a1003457389afb0bf3df12cdbd4458cfce1df
SSDeep 12288:cld7Ux3dgk2L74uD2HdHl+bb5xoXYx+rXf6qn0DHX6:cn72de7WHVl+nPIrXfv2
TLSH 3FE4DF2026604F17EA3A97F24111D13203F85EAC686EE6456FC2BDDF39B9F902990F57
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
68c3115909de6af13b312b691122d19a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
vDFj
Name Value
Module Name
Lvov.exe
Full Name
Lvov.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
Lvov.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lvov
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
Lvov.exe
Full Name
Lvov.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
Lvov.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lvov
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
68c3115909de6af13b312b691122d19a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
vDFj
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
68c3115909de6af13b312b691122d19a
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
68c3115909de6af13b312b691122d19a
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙