Suspicious
Suspect

926b9ec899c4d47efb8b7c2f38ec16e6

Share on LinkedIn
Print
PE Executable
MD5: 926b9ec899c4d47efb8b7c2f38ec16e6
Size: 1.34 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 926b9ec899c4d47efb8b7c2f38ec16e6
Sha1 8006cbb093610b78aad6a271bd6000e89ff71189
Sha256 5c85a30c981d3428c2a25ee4718f45cfe10d2eb0c40d34b92686eee14430da8c
Sha384 68680d1273f13d9bcae100bbbfe988fe9c4da5a95af1c3b38b0267199295b421ac3a62d0aec83147423aaafebfd7428b
Sha512 9476171298c56c555aa798e58033c15c30aca38f53e68fdd3a552a2c06869015ade9785fd24302d7f35cbf6f30e58b0ae01d1c10b372c82ff1b019ab341d09b3
SSDeep 24576:0KO5CY598pPTBnFVe7HVSyvf3EIx20WO45O2onaS/nkLaPlNt:rO5v8TFVCfvfD2xE2aaS/dHt
TLSH C755E0643528AE17C67993F50A71E27403FA2E9A6429D6CE5EC6BDDF7DE0F004E00693
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
926b9ec899c4d47efb8b7c2f38ec16e6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QL_QuanCaPhe.ChiTietHD.resources
QL_QuanCaPhe.DangNhap.resources
Tissue
[NBF]root.Data
btn_DangNhap.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.DoiMatKhau.resources
btn_Doi.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.HoaDon.resources
btn_XemCT.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Xoa.Image
[NBF]root.Data
[NBF]root.Data-preview.png
quayLạiToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_TK.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.KhachHang.resources
btn_Luu.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Reset.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Sua.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Them.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_TimKiem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_TK.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.NhanVien.resources
btn_TaiAnh.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_TK.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.Order.resources
btn_Reset.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Sua.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_ThanhToan.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_Them.Image
[NBF]root.Data
[NBF]root.Data-preview.png
btn_TimKiem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
sảnPhẩmToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
thôngTinCáNhânToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_QL.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_TK.Image
[NBF]root.Data
[NBF]root.Data-preview.png
tàiKhoảnToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
đăngXuấtToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
đổiMậtKhẩuToolStripMenuItem.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.Properties.Resources.resources
Olhq
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.SanPham.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
toolStripDropDownButton_TK.Image
[NBF]root.Data
[NBF]root.Data-preview.png
QL_QuanCaPhe.TaiKhoan.resources
QL_QuanCaPhe.ThemKH.resources
QL_QuanCaPhe.ThongTinNV.resources
QL_QuanCaPhe.XuatHD.resources
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2
Name Value
Module Name
VOLL.exe
Full Name
VOLL.exe
EntryPoint
System.Void QL_QuanCaPhe.Program::Main()
Scope Name
VOLL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VOLL
Assembly Version
3.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
1438
Main Method
System.Void QL_QuanCaPhe.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QL_QuanCaPhe.DangNhap::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
VOLL.exe
Full Name
VOLL.exe
EntryPoint
System.Void QL_QuanCaPhe.Program::Main()
Scope Name
VOLL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VOLL
Assembly Version
3.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1438
Main Method
System.Void QL_QuanCaPhe.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QL_QuanCaPhe.DangNhap::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙