Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 739163e30e6a3465b5f06a72aa7e744c
Size: 975.87 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 739163e30e6a3465b5f06a72aa7e744c
Sha1 b95a1fffd291ea72701c679287aa8c760acfaa96
Sha256 0399cc610cf9002129dfd6666006b3c1469fa796c19e96540aed28cb4e9689c6
Sha384 5991af0a0fbeba5384d41cd632364d3ccb584f8582a4d4d111f53a92bce61c27ca9823072503e35fada8be0eb9983ef3
Sha512 d5f5aaf161c0551329c1378538d4bb2334078d138bae17e3a08f7f894fcbcefc27429e7fba1672ae9317e9536187237aa26ba39531cfe70c12de48e0687ac2a2
SSDeep 24576:KgnbtTxj++lo2a9UxZEYQtow23EjYhpRvy:Ke5Ts+iTUxZU6EAC
TLSH 3E25122A6DE39482D12A3F7545A3C2B885643FDD54B2C7CB6BE63C0F3A31E10F126566
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
739163e30e6a3465b5f06a72aa7e744c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
Name Value
Module Name
ZVqC.exe
Full Name
ZVqC.exe
EntryPoint
System.Void FrontEnd.Program::Main()
Scope Name
ZVqC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZVqC
Assembly Version
25.174.802.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
228
Main Method
System.Void FrontEnd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FrontEnd.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
ZVqC.exe
Full Name
ZVqC.exe
EntryPoint
System.Void FrontEnd.Program::Main()
Scope Name
ZVqC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZVqC
Assembly Version
25.174.802.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
228
Main Method
System.Void FrontEnd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FrontEnd.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Embedded Resources UNKNWOWNsuspect
2huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙