Suspicious
Suspect

a70e3596486fabe206976a5b2283a455

PE Executable
MD5: a70e3596486fabe206976a5b2283a455
Size: 484.35 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 a70e3596486fabe206976a5b2283a455
Sha1 767d665337dc80321e871d7eff7238d6e80c05be
Sha256 baa4644728c7e2bb52305701569700be80e76adf9a50bdca2faa54eed64cfc9f
Sha384 a6b2e03990a3045a0c57bb20ae4fa25544d8adc72e6989fb678cb3949d007b1afee377782f5c6005f802bfd62cda336c
Sha512 3cba5001714fb0693eb4843b43805037234389f607b6ba4d8df3df7a2497a989f4159aa434f55bbeaca3f318a4128a45a1482d9240ab792dc4dceb95c27ddd87
SSDeep 12288:1+gXfGhJHQ9s0KwogZ/LxrLXA4RZ+q8hs/6F1w:cgOhJqVZ/LlXAAZtv6s
TLSH E6A412812929C723C9974BF84975E070B3B87E996911DA059EEB3CEF7839B401B15B83
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a70e3596486fabe206976a5b2283a455
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TipCalculator.Forms.MainForm.resources
TipCalculator.Properties.Resources.resources
DflY
[NBF]root.Data
[NBF]root.Data-preview.png
Math
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: JSYQ.pdb
Module Name
JSYQ.exe
Full Name
JSYQ.exe
EntryPoint
System.Void TipCalculator.Program::Main()
Scope Name
JSYQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JSYQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
207
Main Method
System.Void TipCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void TipCalculator.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
JSYQ.exe
Full Name
JSYQ.exe
EntryPoint
System.Void TipCalculator.Program::Main()
Scope Name
JSYQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JSYQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
207
Main Method
System.Void TipCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void TipCalculator.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
a70e3596486fabe206976a5b2283a455
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TipCalculator.Forms.MainForm.resources
TipCalculator.Properties.Resources.resources
DflY
[NBF]root.Data
[NBF]root.Data-preview.png
Math
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙