Suspicious
Suspect

PE Executable
MD5: 9de694ebca060e6bbf447b0af8444a4e
Size: 996.35 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 9de694ebca060e6bbf447b0af8444a4e
Sha1 24c36330399a35d06d8e70cd824ffc38351015ac
Sha256 7914b50d3cb4dfdbb2cc92b4b833d2e87416c39fb81f8979297a989f9b9c4bed
Sha384 312e5eaec3224a2001e086d97960bd125ac1830a0025b3a96a93d4033c9bb36a33f12c1ca3e81769ea8ff0ac1088d29d
Sha512 5576d948c6d48749b374c5ce50f31c49ca2110d47be4b012a359b6bf8080b5c4697cf43bc3ea063006a9ef3431a8d73517ba5adc25d57dde07fabd711e7f1909
SSDeep 24576:JAIHESgkKzHQSriNCn+W2qWmr4w5ef/fqwEsKc:JBHKkKWNhQ5NBsK
TLSH 762512923517CD41D8B61FB20832D33116B66E9CF495D30F6AE57EAF7A713221882B4B
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
rIu
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: aCT.pdb
Module Name
aCT.exe
Full Name
aCT.exe
EntryPoint
System.Void SmartNote.Program::Main()
Scope Name
aCT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
aCT
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
210
Main Method
System.Void SmartNote.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SmartNote.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
rIu
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙