Suspicious
Suspect

PE Executable
MD5: 70307a189ae4e32b7a5dff16857ab85b
Size: 769.02 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 70307a189ae4e32b7a5dff16857ab85b
Sha1 bf5384e74afb5591fd7d3da294cfb9e874ff59c6
Sha256 1fbbd76779084cc1c6abdc0589285d263f1cc021c7977e7f9fef6bd4db8ab892
Sha384 247c690ad4b4aac178ee6ff8d5ad6a6cde74476dd1acd3a756fc81624e1607bb070ab6f341cc1d14b84ea87a7067c9fe
Sha512 bd7dafa79e72b6872f0e3debffe7ae93195854d37b816d7d5bb9b72f392c47ab2835d97da32ebea3731c4aa6032396933bd8d8e54d597d087cd580dfe66f58b7
SSDeep 12288:PsnbEh2TL9fVLCWIgBZRrknigO7S/xSwb6qGCgHimF3k3QkslEQNC+:PsnbttLLhBroP/xS4BGbi0sQkq5NC
TLSH F6F4121A2DA7C092C1AA2FB489D3C17849743FDA5C73C6DBAFC57C8F3428D52611276A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
70307a189ae4e32b7a5dff16857ab85b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
FrontEnd.MainForm.resources
$this.Icon
DQ
BackEndLibrary.Properties.Resources.resources
SKux
Name Value
Module Name
HhGf.exe
Full Name
HhGf.exe
EntryPoint
System.Void FrontEnd.Program::Main()
Scope Name
HhGf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HhGf
Assembly Version
25.174.802.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
228
Main Method
System.Void FrontEnd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FrontEnd.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
HhGf.exe
Full Name
HhGf.exe
EntryPoint
System.Void FrontEnd.Program::Main()
Scope Name
HhGf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HhGf
Assembly Version
25.174.802.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
228
Main Method
System.Void FrontEnd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FrontEnd.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Embedded Resources UNKNWOWNsuspect
2huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
70307a189ae4e32b7a5dff16857ab85b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
FrontEnd.MainForm.resources
$this.Icon
DQ
BackEndLibrary.Properties.Resources.resources
SKux
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
2huhuhuhu
70307a189ae4e32b7a5dff16857ab85b
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
70307a189ae4e32b7a5dff16857ab85b
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙