Suspicious
Suspect

9c42bed03ed757e70b985a0c6dd51390

PE Executable
MD5: 9c42bed03ed757e70b985a0c6dd51390
Size: 773.64 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 9c42bed03ed757e70b985a0c6dd51390
Sha1 1059aa88065d26c30416efd0498d49f5b59887be
Sha256 f9926b77fd47dffc66e6f22e4ecd4d0f1b1b3e4b768064bb22b64be3094569f6
Sha384 36989ee6ae35b08a19d5efbb6fd930df56a0f1721f35677df9083e1a20da9a12928e7df0c7848224a9187d75c1ab25f6
Sha512 bc49ee735c4219040d5134996f0df3d77e01fd26844b5faef9e6826591bf66929e3d480b592cb57fa0ffd2d0e5a8c0337e7454239c6ec53e4bf3da143cd62358
SSDeep 12288:4Q3L/rb8WkKV+97fQiKUoHCn/pKX2VydUfiBOHaaAWCYeMK4TGNYqLicCEPAjTBy:J7v+Q+7NK7qpy2VyqaBOHaaA5QK4TedZ
TLSH 31F4125A2B4EDD02D4D51F7019A1E3B62730CF49E914C2278FEDBCDFB8A4B122969391
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
oiMundo.Form1.resources
$this.Icon
[NBF]root.IconData
NI
[NBF]root.Data
oiMundo.Properties.Resources.resources
Aevu
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0xB9800 size 13832 bytes
Info
PDB Path: ?
Module Name
SdwY.exe
Full Name
SdwY.exe
EntryPoint
System.Void oiMundo.Program::Main()
Scope Name
SdwY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SdwY
Assembly Version
3.0.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
161
Main Method
System.Void oiMundo.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void oiMundo.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
oiMundo.Form1.resources
$this.Icon
[NBF]root.IconData
NI
[NBF]root.Data
oiMundo.Properties.Resources.resources
Aevu
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙