Suspicious
Suspect

9d742de1427435bf6b989efca7a6609d

PE Executable
MD5: 9d742de1427435bf6b989efca7a6609d
Size: 786.43 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 9d742de1427435bf6b989efca7a6609d
Sha1 5d2c2f7275f2a49c9b66d30460a1e7a8954eacb4
Sha256 e7b49b01463ba069ef6b17e39fea65f06882a23bcbf821e52c5ef357cee141c5
Sha384 1befcbcb0e361344be8c1d4630844124cb6333d98c6bd7a713eeb516b1c3701d622679c3c1fd150769bcd171f3275945
Sha512 764feaf9ce611da7adf889a29cc488a1a92b0ac532204f47f0c4e6c3849535d53b7653e7245dab1897f2b0e101c97d05ddf1e9ae813bdfae3b0a85b73c0b1a3b
SSDeep 12288:UDI4DXZsv85DMynbwvoJLOqOpYOgrf+EHtUhOaGrvy2/hAKEQEZA:5kZsE6ynbwvO6qOiOc+EIOb7nhADA
TLSH 2CF40165325ECD03C94A4AF40861E57513B6AED8E650C3DB8FDB3CDFB6ABB442921243
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9d742de1427435bf6b989efca7a6609d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Calculator.Form1.resources
$this.Icon
[NBF]root.IconData
Clear
[NBF]root.Data
menuStrip1.TrayLocation
Calculator.Form2.resources
Calculator.Properties.Resources.resources
abEO
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
aWWX.exe
Full Name
aWWX.exe
EntryPoint
System.Void Calculator.Program::Main()
Scope Name
aWWX.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aWWX
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
438
Main Method
System.Void Calculator.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Calculator.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
aWWX.exe
Full Name
aWWX.exe
EntryPoint
System.Void Calculator.Program::Main()
Scope Name
aWWX.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aWWX
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
438
Main Method
System.Void Calculator.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Calculator.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
9d742de1427435bf6b989efca7a6609d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0.exif
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Calculator.Form1.resources
$this.Icon
[NBF]root.IconData
Clear
[NBF]root.Data
menuStrip1.TrayLocation
Calculator.Form2.resources
Calculator.Properties.Resources.resources
abEO
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙