Suspicious
Suspect

79632e6ea47abf22b75a1610639fa5b2

PE Executable
|
MD5: 79632e6ea47abf22b75a1610639fa5b2
|
Size: 747.52 KB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
79632e6ea47abf22b75a1610639fa5b2
Sha1
46982645d464196ca5c4b96d94538449eb3d66fc
Sha256
f2215030e25ace46d59ee7ca2fd12c4cfb8d6f220d848e51abd2bbd13c98e071
Sha384
5673f8eb8c56a82d54957d51c983cdc03e9ad738e4a941fe451708afee2360e79643a52c908edeb08c7da184bdfad4d7
Sha512
ea7ee28687509bf96d9ace8307f32ccbb625c8953c8a5f95cea78dd0a9a6c6763043544ee0a1a09c8ca1fb2cd4bdede42f81c6efc391766518df1bbbd2405354
SSDeep
12288:RTbgzzuzAocQ+7FlxlDxOeaFZH4Gp32jq9XrLXEWJ//3plP:RTJzAA6FlxlD8LrlvXZ5lP
TLSH
0CF40108311ACB06C87A8BB41A36D2F013B66E8D6821D71E9ED67EEF3C7AB411705757

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HTA_pharmacy.Form1.resources
HTA_pharmacy.Form3.resources
$this.AutoScaleDimensions
$this.ClientSize
$this.Margin
button1.Font
button1.Location
button1.Size
button2.Font
button2.Location
button3.Location
button3.Size
button4.Location
button4.Size
button5.Location
button6.Location
dataGridView1.Location
dataGridView1.Size
dateTimePicker1.Location
dateTimePicker1.Size
label1.Location
label1.Size
label3.Location
label3.Size
label4.Location
label4.Size
textBox1.Location
textBox1.Size
textBox2.Location
HTA_pharmacy.Properties.Resources.resources
FntB
[NBF]root.Data
[NBF]root.Data-preview.png
MR
[NBF]root.Data
Informations
Name
Value
Module Name

tGwY.exe

Full Name

tGwY.exe

EntryPoint

System.Void HTA_pharmacy.Program::Main()

Scope Name

tGwY.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

tGwY

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

351

Main Method

System.Void HTA_pharmacy.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void HTA_pharmacy.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

tGwY.exe

Full Name

tGwY.exe

EntryPoint

System.Void HTA_pharmacy.Program::Main()

Scope Name

tGwY.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

tGwY

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

351

Main Method

System.Void HTA_pharmacy.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void HTA_pharmacy.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Artefacts
Name
Value
PDB Path

tGwY.pdb

79632e6ea47abf22b75a1610639fa5b2 (747.52 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙