Suspicious
Suspect

be9a5cbeb97f025e4eeaccfd101425f7

PE Executable
MD5: be9a5cbeb97f025e4eeaccfd101425f7
Size: 738.3 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 be9a5cbeb97f025e4eeaccfd101425f7
Sha1 29c49e161b9e3f42155dc2049ce8259004c3071f
Sha256 cb790da32e10f49e2380dee82c875487e378e23175ef7f124f437a3ae4413ecf
Sha384 4eed7d1aad2f1f88fa449f0612407dd38af529696ec80d1ed52e5ab89073abe9bbc11214fd77f0e2bd0627fbe0ef3372
Sha512 09584e4552c4ab204b069993bb04771244c304e497511426eb500dfc2b929e7d9453a350a3d7ffc8fa79317d7d92fb0758a3003cb7d309abb0f334bbc10375fe
SSDeep 12288:PmhbCGcnuWgrgCQEY0yVAUUmhrFd4dtgEpNBoJz4CKRVSpBttictZszRue1eW7d:0WBqrgCxUTwVbCKRVCBttictZzeeWB
TLSH C2F412957649C906C2B21BB05C60D3F8127DAFCE7821D3438EF9BDFBBD3A6456580252
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
be9a5cbeb97f025e4eeaccfd101425f7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNotesApp.Properties.Resources.resources
AjUi
[NBF]root.Data
[NBF]root.Data-preview.png
htta
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: WAIz.pdb
Module Name
WAIz.exe
Full Name
WAIz.exe
EntryPoint
System.Void SmartNotesApp.Program::Main()
Scope Name
WAIz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WAIz
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
76
Main Method
System.Void SmartNotesApp.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SmartNotesApp.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
WAIz.exe
Full Name
WAIz.exe
EntryPoint
System.Void SmartNotesApp.Program::Main()
Scope Name
WAIz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WAIz
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
76
Main Method
System.Void SmartNotesApp.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SmartNotesApp.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
be9a5cbeb97f025e4eeaccfd101425f7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNotesApp.Properties.Resources.resources
AjUi
[NBF]root.Data
[NBF]root.Data-preview.png
htta
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙