Suspicious
Suspect

89639ca126abaab1152896a3decacf3b

PE Executable
MD5: 89639ca126abaab1152896a3decacf3b
Size: 744.96 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 89639ca126abaab1152896a3decacf3b
Sha1 53933129c3f7089a14a7d6064830166396a191a9
Sha256 db2b7020233579fb99689c7e706545b2d7eefa8a83ef24160831c8fc982a1b4c
Sha384 434b27ce91f3f1f46d6e3deff9f10d49454b544e3e71aa84ea85c8fcc49626d5f8c69a3d65aa458b2fd404d1d66214ef
Sha512 2c841d50b4759c0f120ae92f53c51babbf9c488c97404f1a6ec6fc5df5aecb83bf1f00b7693d0b070671c8afe540f2d1345ccd59d7e5f4d0843c76378d06209c
SSDeep 12288:ntPfqXuQcVbXCkyV72pqk+VR5FLkqXWeMYDOhmogP5npCSItLOwUNuugL:nteuRbYd2p/+nrLkMWdYUgPnCSItBtrL
TLSH 31F412802755DA17C1B107F46D71CBB827B91E8E2811C31B8EFABCDF7E723556A81286
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
89639ca126abaab1152896a3decacf3b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
KOh
[NBF]root.Data
[NBF]root.Data-preview.png
KOp
[NBF]root.Data
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: VPY.pdb
Module Name
VPY.exe
Full Name
VPY.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
VPY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VPY
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
VPY.exe
Full Name
VPY.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
VPY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VPY
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
89639ca126abaab1152896a3decacf3b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
KOh
[NBF]root.Data
[NBF]root.Data-preview.png
KOp
[NBF]root.Data
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙