Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: b34efea89f865b42a04d479378d56476
Size: 572.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 b34efea89f865b42a04d479378d56476
Sha1 292d32a75160575d54dea70a153fd9f7b8996d9e
Sha256 a6ceb6d25a1ced915f258bb23cf84d6473b0bc9a9ba1e6f4ed608591ca462166
Sha384 c0ae2ab6b7a49f438b3456a298a4c6dab6c97aeb437777af6a986c269a0649b70b7eca8dd872ed7ed1c981aa8e7e6708
Sha512 ce97a8a478f81f3b36b2b851fb9098664fdce52e7a440ac0832ec72bbb1f81d7840f5c32d422b44ba99218d4cb26b79c4b7e8582641a99c611c19f0073ea9628
SSDeep 12288:s+bnbtCKJ74Elxw++AucbCdtBq2w3Sh0pe09QFasxkY:sQzcEWA2dtFI9bsx
TLSH 38C4EF8BF2C4E403D8024E703B61F6B0DDEE6CD8981ED5A7ABE87E8B7DB55195923101
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b34efea89f865b42a04d479378d56476
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NMBSTracker.Form1.resources
$this.Icon
[NBF]root.IconData
DelayNotification.Icon
[NBF]root.IconData
DelayNotification.TrayLocation
GSA
[NBF]root.Data
UpdateTimer.TrayLocation
NMBSTracker.Properties.Resources.resources
RFbU
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\XargYjBawa\src\obj\Debug\CSVR.pdb
Module Name
CSVR.exe
Full Name
CSVR.exe
EntryPoint
System.Void NMBSTracker.Program::Main()
Scope Name
CSVR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CSVR
Assembly Version
201.502.607.709
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
132
Main Method
System.Void NMBSTracker.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void NMBSTracker.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
CSVR.exe
Full Name
CSVR.exe
EntryPoint
System.Void NMBSTracker.Program::Main()
Scope Name
CSVR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CSVR
Assembly Version
201.502.607.709
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
132
Main Method
System.Void NMBSTracker.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void NMBSTracker.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙