Suspicious
Suspect

PE Executable
MD5: 99c99c59648e82f507576acb4dd6211a
Size: 689.66 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 99c99c59648e82f507576acb4dd6211a
Sha1 e7fa734e3f03e71c10477c1138fa2ee7a0901617
Sha256 3da3b1bc37004b4857d1f3afe3f740fe449bb441070d314dbbca2b5da674654e
Sha384 6f384d1e38c706370ca457fc87970631af72b64f4b72fce342effbdaa811843b9fd77867621490b0e970b1b3396c80e2
Sha512 75edf87202b7a21054a41c033fa498b8384fd7ef665f08b0bf38515bfe666631f1f35a3055f201320210f2d123a9ec4aa5f902206dfe333cee460b24f1f8a732
SSDeep 12288:EcDryY8MuzJF7VWvmc5PniU4hYO/Wu+gOqsVIX1FG0dERcppcszM:Ec/yGWJF7VWumSNOu+gODIlFGcE+pm
TLSH 7CE41259378AD823D4A627B48DB1E3FD03B89E99B405D38A4DFAFCE7782570456902C3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
99c99c59648e82f507576acb4dd6211a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DirectoryPlus.MainForm.resources
DirectoryPlus.Properties.Resources.resources
BOlS
[NBF]root.Data
[NBF]root.Data-preview.png
gilek
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: gxxk.pdb
Module Name
gxxk.exe
Full Name
gxxk.exe
EntryPoint
System.Void DirectoryPlus.Program::Main()
Scope Name
gxxk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gxxk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
161
Main Method
System.Void DirectoryPlus.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void DirectoryPlus.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
gxxk.exe
Full Name
gxxk.exe
EntryPoint
System.Void DirectoryPlus.Program::Main()
Scope Name
gxxk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gxxk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
161
Main Method
System.Void DirectoryPlus.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void DirectoryPlus.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
99c99c59648e82f507576acb4dd6211a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DirectoryPlus.MainForm.resources
DirectoryPlus.Properties.Resources.resources
BOlS
[NBF]root.Data
[NBF]root.Data-preview.png
gilek
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙