Suspicious
Suspect

8bf85a228d23029f6d57529608556492

PE Executable
MD5: 8bf85a228d23029f6d57529608556492
Size: 720.38 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8bf85a228d23029f6d57529608556492
Sha1 71fe43a1dfb9af1a622b12313f858fe3a649d2cc
Sha256 d5bd67edddb02aaf59ac0743bc2ad8fe235ee8b4cda045e2475193cb8ccca8ff
Sha384 6eee47d078836b6c8806db980a3858e72a280f90f0862b652f38763e2506193538b4d21e4e4b6eaaff0e14c6287277f4
Sha512 ec98b9c236c5737b914c84d5a9c374d014ff6d1ee55b7fbc83601df231b9485ceae4416532943d3b2cfd3beb1e347339d720895a55fb9dfb39a6e59e6ea80804
SSDeep 12288:JP5MTZ9DSgTfc5SBlz2hs0YP5dPfg8uPKTSzQoY47EvT7asttI4Kbh7NQuZCbAoP:QTfWgTfPX2urRg8uyTSBEv/tzKbh7NvY
TLSH 1BE4230EBE96CA5ACF9C097BC6B35040167F8926E091F757A9EC08F0DC22719DD5F684
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8bf85a228d23029f6d57529608556492
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
RZKJ.exe
Full Name
RZKJ.exe
EntryPoint
System.Void CommonPractice.Program::Main()
Scope Name
RZKJ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RZKJ
Assembly Version
6.9.5.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
2
Main Method
System.Void CommonPractice.Program::Main()
Main IL Instruction Count
41
Main IL 
ldsfld System.Int32[] CommonPractice.HelperClasses.SysColorsExtensions::Ⴐ
stloc.2 <null>
ldc.i4.1 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void CommonPractice.HelperClasses.SysColors::Ⴓ()
ldc.i4.s 56
ldc.i4.s 78
call System.Void CommonPractice.Properties.Resources::Ⴓ(System.Int32,System.Int16)
ldc.i4.0 <null>
ldc.i4 195
ldc.i4 174
call System.Void CommonPractice.HelperClasses.SysColors::Ⴐ(System.Boolean,System.Int16,System.Int32)
ldloc.2 <null>
ldc.i4 407
ldelem.i4 <null>
ldloc.2 <null>
ldc.i4 407
ldelem.i4 <null>
sub <null>
stloc.1 <null>
br.s IL_0008: ldloc.1
newobj System.Void CommonPractice.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4 301
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4 301
ldelem.i4 <null>
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4.s 94
ldelem.i4 <null>
sub <null>
ldc.i4.s 11
and <null>
stelem.i4 <null>
ret <null>
ldtoken System.Void CommonPractice.Program::Main()
pop <null>
ret <null>
Module Name
RZKJ.exe
Full Name
RZKJ.exe
EntryPoint
System.Void CommonPractice.Program::Main()
Scope Name
RZKJ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RZKJ
Assembly Version
6.9.5.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
2
Main Method
System.Void CommonPractice.Program::Main()
Main IL Instruction Count
41
Main IL 
ldsfld System.Int32[] CommonPractice.HelperClasses.SysColorsExtensions::Ⴐ
stloc.2 <null>
ldc.i4.1 <null>
stloc.1 <null>
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
call System.Void CommonPractice.HelperClasses.SysColors::Ⴓ()
ldc.i4.s 56
ldc.i4.s 78
call System.Void CommonPractice.Properties.Resources::Ⴓ(System.Int32,System.Int16)
ldc.i4.0 <null>
ldc.i4 195
ldc.i4 174
call System.Void CommonPractice.HelperClasses.SysColors::Ⴐ(System.Boolean,System.Int16,System.Int32)
ldloc.2 <null>
ldc.i4 407
ldelem.i4 <null>
ldloc.2 <null>
ldc.i4 407
ldelem.i4 <null>
sub <null>
stloc.1 <null>
br.s IL_0008: ldloc.1
newobj System.Void CommonPractice.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4 301
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4 301
ldelem.i4 <null>
ldsfld System.Int32[] CommonPractice.BaseJetNotifyClasses.Person::Ⴃ
ldc.i4.s 94
ldelem.i4 <null>
sub <null>
ldc.i4.s 11
and <null>
stelem.i4 <null>
ret <null>
ldtoken System.Void CommonPractice.Program::Main()
pop <null>
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
8bf85a228d23029f6d57529608556492
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
Embedded Resources UNKNWOWN
0huhuhuhu
8bf85a228d23029f6d57529608556492
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
8bf85a228d23029f6d57529608556492
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙