Suspicious
Suspect

76d22b1d56fc7c97d4ef5d315ac66a63

PE Executable
MD5: 76d22b1d56fc7c97d4ef5d315ac66a63
Size: 823.3 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 76d22b1d56fc7c97d4ef5d315ac66a63
Sha1 ecf22e8944e4ec166007fd356a41d0a3eda0a2bf
Sha256 81c81ed0c8aa166aeb5da40c7ebc105f6d51824b1d116d9cd548e0883b8ab92e
Sha384 38856ac7c45449e002d6bd4282a57668a9aa243c96b0683f2a98b598088e0ea1c81afa40877bcddeb31bd34c71bf22ce
Sha512 f62005f2d98d5c8f4a6055a1f6b6cc22a50019be4aed21a3278d14324faa17cb908e66fd826c8a195501225a02369f27cdb4cb39fc6f4ec52b55df5b3adb326e
SSDeep 12288:DdTDN6jbE7UEOzIv0F1TG75dvWhgvxh/ANyyA/Y0hkE1/BTddijSubd1x9x:BNZUEOzrPG75kgNyuY21YjSGd9
TLSH 9C05022832198407C654A3F85A71E2B807792ED9B522D3E28FDA7DEB78F5F414D40B93
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Oversee.fAccountProfile.resources
Oversee.fAdmin.resources
Oversee.flogin.resources
$this.Icon
[NBF]root.IconData
Resite
[NBF]root.Data
Oversee.Properties.Resources.resources
zkpG
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2
Name Value
Module Name
WtJv.exe
Full Name
WtJv.exe
EntryPoint
System.Void Oversee.Program::Main()
Scope Name
WtJv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WtJv
Assembly Version
11.4.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
322
Main Method
System.Void Oversee.Program::Main()
Main IL Instruction Count
6
Main IL
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Oversee.flogin::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Oversee.fAccountProfile.resources
Oversee.fAdmin.resources
Oversee.flogin.resources
$this.Icon
[NBF]root.IconData
Resite
[NBF]root.Data
Oversee.Properties.Resources.resources
zkpG
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙