Suspicious
Suspect

a3bff03342f1ce443cb94b39b3876535

PE Executable
MD5: a3bff03342f1ce443cb94b39b3876535
Size: 679.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 a3bff03342f1ce443cb94b39b3876535
Sha1 7c79259ffad48aa8c7421ea9c015d04c794e3bfc
Sha256 e1a0771b4e2b6524eee712641b99aa2890a5e3a7bd2664b70db58049a973a9e5
Sha384 ce56f341b39e0f3399015dca9ace302faa12b9900b03af49a0c740ab0a3e4005c02ab48c9df04ea150581af5dc0263a2
Sha512 f3b988916eea61311ec7bbc25f5d8cd56fa62bcce8cca4282a336920aedae2991d20a61bcdf7145f3640f4ceb9125bf5aec0bc73376a6b09fdb6ab43e9c4b7ab
SSDeep 12288:j71RcGrANcyts1yjpl8AijjbNEizryHIVENHlur9:PL3POs1eONbOzHluJ
TLSH 46E4125126AAC903D0F60F761921D57503F6AEDAB816E31B0FE4BDCFB936B901A81347
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
IrJ
[NBF]root.Data
[NBF]root.Data-preview.png
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: bkg.pdb
Module Name
bkg.exe
Full Name
bkg.exe
EntryPoint
System.Void SmartNote.Program::Main()
Scope Name
bkg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bkg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
210
Main Method
System.Void SmartNote.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SmartNote.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
IrJ
[NBF]root.Data
[NBF]root.Data-preview.png
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙