Suspicious
Suspect

9d36fdafa287dababfce7004edb2f790

PE Executable
MD5: 9d36fdafa287dababfce7004edb2f790
Size: 723.97 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 9d36fdafa287dababfce7004edb2f790
Sha1 c544a99918fd04efcdf1bc188743fa6123fe5bc9
Sha256 fd85a4e75158f628b44a723f2bffc2d6bae956051fc2495256011b9d552d9164
Sha384 0bb8b79473e0f6cef34e197df8236351b9567fc16dbb9931801250faa4eb856378ad10ea7d1dbeb53b404314fdeb7439
Sha512 e6bc8e07a28e70e3144c5816e6785d45fff58af67dc2988d72b537ba885cdbb729887c7b6b491d395842722ea045e20a51eb75fa15dc65b689597033a3bde014
SSDeep 12288:uJriISA95HJEbLN/kt5dHXfDhuJuyAPUTVTbZGtV5h1tRSrfMx2FU1BHjG0gB:fISA9puP+Ld3fluNAPOTMv1tRkG2FqH6
TLSH 70F41291534ACA02D4A603F52C92E7B4A36E1FEE7421C317AEEEBCEB3C397057990551
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WordScrambleGame.DifficultyForm.resources
WordScrambleGame.Properties.Resources.resources
Lachen
[NBF]root.Data
[NBF]root.Data-preview.png
Like
[NBF]root.Data
[NBF]root.Data-preview.png
True
[NBF]root.Data
cOes
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: USoO.pdb
Module Name
USoO.exe
Full Name
USoO.exe
EntryPoint
System.Void WordScrambleGame.Program::Main()
Scope Name
USoO.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
USoO
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
167
Main Method
System.Void WordScrambleGame.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WordScrambleGame.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WordScrambleGame.DifficultyForm.resources
WordScrambleGame.Properties.Resources.resources
Lachen
[NBF]root.Data
[NBF]root.Data-preview.png
Like
[NBF]root.Data
[NBF]root.Data-preview.png
True
[NBF]root.Data
cOes
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙