Suspicious
Suspect

PE Executable
MD5: 6f858816b9b2b65ba0122339b16254db
Size: 903.68 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 6f858816b9b2b65ba0122339b16254db
Sha1 ef36416ed63bafde6eea610f4f29be90dad7b4a2
Sha256 368c3f4373be7b2de2adb08b623315e12d69d4d3f174c6a5d5b3e892a85fee51
Sha384 d84193d0808fd23e723061b121a45c0e283a8edd3bc79e7f2ef958a549e54b3e58045d8755513a378965f9112218b537
Sha512 1044fb371f8cf4f89177f96dcc1aaf14d3d28982210a2485eb13737c9288590fe81a4e65943268fce830a462bb0929cf697c754e261a33752f55a8f5ab08e74d
SSDeep 24576:oh72Ql9JZ0hwFhnFz+jxCtS7YSj2SF/GtCGZhWsBD:2Z9b0KrnFMxCcE0D/GtGsBD
TLSH 6B15E01027249F16EA7A8BF60421E13203B85E9DA96DE2456FC1BCDF3C79F506990F27
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6f858816b9b2b65ba0122339b16254db
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
HsVv
Name Value
Module Name
qyaY.exe
Full Name
qyaY.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
qyaY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
qyaY
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
qyaY.exe
Full Name
qyaY.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
qyaY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
qyaY
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6f858816b9b2b65ba0122339b16254db
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
HsVv
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
6f858816b9b2b65ba0122339b16254db
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
6f858816b9b2b65ba0122339b16254db
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙