Suspicious
Suspect

75126563c59c3503c9bb69855a8a4f4a

PE Executable
MD5: 75126563c59c3503c9bb69855a8a4f4a
Size: 975.36 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 75126563c59c3503c9bb69855a8a4f4a
Sha1 09645256b8272f95093a0914dde0d05770747357
Sha256 6e482ca3bf3fcc53e4e91c43c50b1720a48090f3149fe7ff760c447a37c1ef04
Sha384 637405559632824f3d822abc5e9c45ed9b8d3d04bdffd58848c884e844b9ed6046a39889750262f235135999670e2662
Sha512 1391eef4e59623cccf1a3c0d3b3e4eb90ad81f550d6486773019b4d476d9274badafdf2bd6b783aed7005c98d0930332e2a583bfd74ad58cf333c01f3261b661
SSDeep 24576:SQZVaiXDiWjjp4ZR/M6RqpoObTvmxoW02dXLJXPq4uYa1K5K:pygiWjjpmHRwoQZW02zXPqNYa85
TLSH 85251258638ECA02C5F203B64D55E77463F5FE6AB512E2418FEE9CEB7922B166C00743
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
75126563c59c3503c9bb69855a8a4f4a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TermiteMound.Properties.Resources.resources
Cringe
[NBF]root.Data
fJCz
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ZkTk.exe
Full Name
ZkTk.exe
EntryPoint
System.Void TermiteMound.Program::Main()
Scope Name
ZkTk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZkTk
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
419
Main Method
System.Void TermiteMound.Program::Main()
Main IL Instruction Count
60
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br.s IL_007C: ldloc.1
nop <null>
ldsfld System.Single[] TermiteMound.Program::robitnykyX
ldloc.1 <null>
ldloc.0 <null>
ldc.i4.s 50
ldc.i4 250
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Single[] TermiteMound.Program::robitnykyY
ldloc.1 <null>
ldloc.0 <null>
ldc.i4 150
ldc.i4 350
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Single[] TermiteMound.Program::robitnykySpeed
ldloc.1 <null>
ldloc.0 <null>
callvirt System.Double System.Random::NextDouble()
ldc.r8 3
mul <null>
ldc.r8 1
add <null>
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Int32[] TermiteMound.Program::robitnykyTunnel
ldloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stelem.i4 <null>
nop <null>
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 25
clt <null>
stloc.2 <null>
ldloc.2 <null>
brtrue.s IL_0018: nop
newobj System.Void TermiteMound.KupynaForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
ZkTk.exe
Full Name
ZkTk.exe
EntryPoint
System.Void TermiteMound.Program::Main()
Scope Name
ZkTk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZkTk
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
419
Main Method
System.Void TermiteMound.Program::Main()
Main IL Instruction Count
60
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
br.s IL_007C: ldloc.1
nop <null>
ldsfld System.Single[] TermiteMound.Program::robitnykyX
ldloc.1 <null>
ldloc.0 <null>
ldc.i4.s 50
ldc.i4 250
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Single[] TermiteMound.Program::robitnykyY
ldloc.1 <null>
ldloc.0 <null>
ldc.i4 150
ldc.i4 350
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Single[] TermiteMound.Program::robitnykySpeed
ldloc.1 <null>
ldloc.0 <null>
callvirt System.Double System.Random::NextDouble()
ldc.r8 3
mul <null>
ldc.r8 1
add <null>
conv.r4 <null>
stelem.r4 <null>
ldsfld System.Int32[] TermiteMound.Program::robitnykyTunnel
ldloc.1 <null>
ldloc.0 <null>
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stelem.i4 <null>
nop <null>
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 25
clt <null>
stloc.2 <null>
ldloc.2 <null>
brtrue.s IL_0018: nop
newobj System.Void TermiteMound.KupynaForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
75126563c59c3503c9bb69855a8a4f4a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TermiteMound.Properties.Resources.resources
Cringe
[NBF]root.Data
fJCz
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙