Suspicious
Suspect

782853362f2750825e917f7751fde42e

PE Executable
MD5: 782853362f2750825e917f7751fde42e
Size: 491.52 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 782853362f2750825e917f7751fde42e
Sha1 cabe9022e7a3591532315677b877cdcfb8cdfa9b
Sha256 b937a657e71426532663aad81c3aecdac2f71f39a39644e8dbbe2e00743daef9
Sha384 26b6d3af8944f585e13536a8350b095279b79dfa3e3ad084c997c2234a15dad26e0e04a2eb3ba9f301ce7851744e6401
Sha512 06741c58682524e50fd47097c2bdd92bc217346fdb4ec45bfcd803c74a6bbd7a4e6ebe0a5c2241e171eefd8a970d0c9b907e1b3886d0e39521d4cd2dc884d722
SSDeep 12288:HJhqhqhbCcFpe5VKJqjZylUMSZSWmWXiYg7sh:HJhqhqh9cjbjZBJZSWmWssh
TLSH 74A4E1593259FC03C56A0FF80D30D7B903B98D5CA416E2979FF6ACEB79E9B412904293
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DesktopProject.AddEmployee.resources
DesktopProject.DeleteEmployee.resources
$this.Icon
[NBF]root.IconData
DesktopProject.Properties.Resources.resources
Teacher
[NBF]root.Data
dYrX
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\vZiyRfsOxH\src\obj\Debug\LRgW.pdb
Module Name
LRgW.exe
Full Name
LRgW.exe
EntryPoint
System.Void DesktopProject.Program::Main()
Scope Name
LRgW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LRgW
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
270
Main Method
System.Void DesktopProject.Program::Main()
Main IL Instruction Count
6
Main IL
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void DesktopProject.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
LRgW.exe
Full Name
LRgW.exe
EntryPoint
System.Void DesktopProject.Program::Main()
Scope Name
LRgW.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LRgW
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
270
Main Method
System.Void DesktopProject.Program::Main()
Main IL Instruction Count
6
Main IL
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void DesktopProject.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DesktopProject.AddEmployee.resources
DesktopProject.DeleteEmployee.resources
$this.Icon
[NBF]root.IconData
DesktopProject.Properties.Resources.resources
Teacher
[NBF]root.Data
dYrX
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙