Suspicious
Suspect

PE Executable
MD5: 899239d20a6290285192385f50964de9
Size: 576 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 899239d20a6290285192385f50964de9
Sha1 9ca5cf523e851489461a5a03cd6019f5d50882f9
Sha256 16cdb69b5e6d2903d654ffced05bd03d303587db0f307137d8a588138a658b3d
Sha384 c28cd517939491ea6c60bb9dd70fa9f8b81d658c7971915928dee9aeac90fd52756f2dd66fa3de157d4aa3343c228431
Sha512 5435843c95c9da68ca32992d59dd51fdbe6c0ba910611dd516760db69d28305f0d4ed003d6a573a2e491f939f091ad528da588f8f31a5b2c405b85b69c4c656a
SSDeep 12288:RlLOwUNnVV7s32AN3L/YtAEwmzS9UPLTQZlJnNTRjZQ9c+iMH5ugz:RlBGVVYJ32AjJ9MTKfnNdNO7iMZrz
TLSH ADC402542A7ADA13D5E15BF09D71D3B803B85E9EB810C35A9FF5BCEB39363142980293
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
899239d20a6290285192385f50964de9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
KOp
[NBF]root.Data
hdw
[NBF]root.Data
[NBF]root.Data-preview.png
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
uVs.exe
Full Name
uVs.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
uVs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uVs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
uVs.exe
Full Name
uVs.exe
EntryPoint
System.Void WindowsContacts.Program::Main()
Scope Name
uVs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uVs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
208
Main Method
System.Void WindowsContacts.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WindowsContacts.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
uVhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
899239d20a6290285192385f50964de9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsContacts.AddEditContactForm.resources
WindowsContacts.Properties.Resources.resources
KOp
[NBF]root.Data
hdw
[NBF]root.Data
[NBF]root.Data-preview.png
kupa
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
uVhuhuhuhu
899239d20a6290285192385f50964de9
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙