Suspicious
Suspect

a85f05adeae7653f2c7946dbcd208c1b

PE Executable
MD5: a85f05adeae7653f2c7946dbcd208c1b
Size: 1.15 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 a85f05adeae7653f2c7946dbcd208c1b
Sha1 91095ced3fab41c5fed3f5f6cd0108b735e6030b
Sha256 dcdde603c0d66e1716ef4c7e8596a11d2818c2151b6c440108ff12f079c3ec7d
Sha384 1f0342150f84b431fe8f9487be8324aad3db453432f9e2bec1ddc0e13441a14d7c8ef882402381fbb0636980dff04e6e
Sha512 825b1bb197da0858ebea67b8d91381397429b9f4904ea2b225566d70e81d7b34cd3c96452c3f9ee0d6abda2d532feeb9647799bcbeb74bb9fe1b64df10e50b6e
SSDeep 24576:FdAr2gM2WsXp6slMdIOBqgZK9HiLZu5Ix4wwp3EdN2Cd6QYZJwTz3rRdmZd:AvJTZ6slM3UKBLZFoEWZQuUr6Zd
TLSH 4A350148220AC906C4564EB01A3DF6F81B599FD9E911D213EFEBBEEFF9F75102906241
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a85f05adeae7653f2c7946dbcd208c1b
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
iNSa
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
ktxB.exe
Full Name
ktxB.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
ktxB.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ktxB
Assembly Version
12.12.12.12
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\LOQyyDstwW\src\obj\Debug\ktxB.pdb
Module Name
ktxB.exe
Full Name
ktxB.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
ktxB.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ktxB
Assembly Version
12.12.12.12
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
a85f05adeae7653f2c7946dbcd208c1b
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
iNSa
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙