Suspicious
Suspect

96edbdcccc77d8acaab5450591cce27e

PE Executable
|
MD5: 96edbdcccc77d8acaab5450591cce27e
|
Size: 711.68 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
96edbdcccc77d8acaab5450591cce27e
Sha1
15e10cba1c4b41e9e44d01948fc58b616f31fdeb
Sha256
a8cdfa7e2c10da2b86a2c1824415310726630037cdb268ff2a40763aa811b632
Sha384
cdcca20693cc1edcb75b520260bcd74b4f19ed073271ecb9363f899a1f57118915c19aed7332f22d13ac84a6ea75baaf
Sha512
4e51d3ddb24106213e135a4cb1da52dfefa318bb53bd446d9fc3d4e25afe519e72e757bef23e84e24481175bb9c4d6cffd173ac1c833424d988931652e83b6cb
SSDeep
12288:s+rWKDQ2m5ihaTASZWj6hg5Ll2KTUSfFJHjCbe8P2LKpLpO0M39y:5yK9m5XTBc6hgJl2KTVPHjCb6ELk0M3Q
TLSH
9DE412283385F921E48A5BF04570E77653788FCBB823C3179AEEEDCBB91A7513854192

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NetworkMonitor.Properties.Resources.resources
JhtF
[NBF]root.Data
[NBF]root.Data-preview.png
cgi
[NBF]root.Data
Informations
Name
Value
Module Name

EKzz.exe

Full Name

EKzz.exe

EntryPoint

System.Void NetworkMonitor.Program::Main()

Scope Name

EKzz.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

EKzz

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

113

Main Method

System.Void NetworkMonitor.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void NetworkMonitor.Forms.NetworkUtilitiesForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

EKzz.exe

Full Name

EKzz.exe

EntryPoint

System.Void NetworkMonitor.Program::Main()

Scope Name

EKzz.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

EKzz

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

113

Main Method

System.Void NetworkMonitor.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void NetworkMonitor.Forms.NetworkUtilitiesForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Artefacts
Name
Value
PDB Path

EKzz.pdb

96edbdcccc77d8acaab5450591cce27e (711.68 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NetworkMonitor.Properties.Resources.resources
JhtF
[NBF]root.Data
[NBF]root.Data-preview.png
cgi
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
Artefacts
Name
Value Location
PDB Path

EKzz.pdb

96edbdcccc77d8acaab5450591cce27e

You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙