Suspicious
Suspect

PE Executable
MD5: c31d1f40e6fe5d97c09320e02feae214
Size: 1.26 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 c31d1f40e6fe5d97c09320e02feae214
Sha1 61e1f354542093965d5abdf9ef67f5fd7f7a1454
Sha256 b3b7337ffa853220cf4ba2ede1ca79e5e291eb57e60b87a416fd0ce0d08f6801
Sha384 aaca749a6457a320d450da29d67297fa6b8ee83f2ebbb8c2a0739f2dc381bdc3217256d28f638c03c9f55d814cc5e11b
Sha512 17638871062e9f5229c147cda20a31f6f1a3e818a932981e82c0ff0d2cc9f0fa8b54c53b9f088b7945808571eccdba096e06b7d02cb19f2e17d19ee68f569e07
SSDeep 24576:8dMbd3YhZo5hVg56smAOP36OJtTw7XLjKRGYM:ldd5hVu6jZqOJtQXL+RG3
TLSH BE451254236AEE01E6AA5FF008B0D3B117756E49F414C34A5EFAACFF7476B901A60393
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
c31d1f40e6fe5d97c09320e02feae214
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
BaselineTool.Forms.MainForm.resources
BaselineTool.Properties.Resources.resources
AUDI
[NBF]root.Data
QTaF
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x130A00 size 13832 bytes
Info
PDB Path: rCxY.pdb
Module Name
rCxY.exe
Full Name
rCxY.exe
EntryPoint
System.Void BaselineTool.Program::Main()
Scope Name
rCxY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rCxY
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
346
Main Method
System.Void BaselineTool.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void BaselineTool.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
rCxY.exe
Full Name
rCxY.exe
EntryPoint
System.Void BaselineTool.Program::Main()
Scope Name
rCxY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rCxY
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
346
Main Method
System.Void BaselineTool.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void BaselineTool.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
c31d1f40e6fe5d97c09320e02feae214
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
BaselineTool.Forms.MainForm.resources
BaselineTool.Properties.Resources.resources
AUDI
[NBF]root.Data
QTaF
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙