Suspicious
Suspect

b338b482bcdd1d1073a883faec4d87ab

PE Executable
MD5: b338b482bcdd1d1073a883faec4d87ab
Size: 744.96 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 b338b482bcdd1d1073a883faec4d87ab
Sha1 b42848de48880d0c9964b087560e09e40206fba9
Sha256 d491c15add4aebfad993dc9eb7b21d5f00d373e1e4acab3b6393c9568bdb26bc
Sha384 97f37c28495cb4301976e992e3f67f81c7b82e2c641a2304ba15d356ae16e5b10e76de2e9dc17e1613528e2ef4ff7681
Sha512 7cdb68771e9b4d9ddeb50d233fe40d053aa92e7bd20c64bc5e8824a91b7162f8763874b2deabaee5274141ad2cc94f78681cf0140467fe270eba0bf3ad8b3dee
SSDeep 12288:8NtVfb11+vZzBshIlt888ta4rmhxbXG0T1w3yO7xKqX:8NtVL4NshubSak4xbXFw3L1
TLSH E3F4BFB1F2B58845D49963714926D83421E31EBCECA0D30EC5DA7DAB79B3FC2089690F
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b338b482bcdd1d1073a883faec4d87ab
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Zapsinaya_knizka_new.Form01.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Form1.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Properties.Resources.resources
dQwT
[NBF]root.Data
[NBF]root.Data-preview.png
de
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
YlnP.exe
Full Name
YlnP.exe
EntryPoint
System.Void Zapsinaya_knizka_new.Program::Main()
Scope Name
YlnP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YlnP
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
217
Main Method
System.Void Zapsinaya_knizka_new.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Zapsinaya_knizka_new.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
YlnP.exe
Full Name
YlnP.exe
EntryPoint
System.Void Zapsinaya_knizka_new.Program::Main()
Scope Name
YlnP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YlnP
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
217
Main Method
System.Void Zapsinaya_knizka_new.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void Zapsinaya_knizka_new.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
b338b482bcdd1d1073a883faec4d87ab
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Zapsinaya_knizka_new.Form01.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Form1.resources
$this.Icon
[NBF]root.IconData
Zapsinaya_knizka_new.Properties.Resources.resources
dQwT
[NBF]root.Data
[NBF]root.Data-preview.png
de
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙