Suspicious
Suspect

PE Executable
MD5: c51dfc49efea134e52de3e2b2d9cd145
Size: 1.33 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 c51dfc49efea134e52de3e2b2d9cd145
Sha1 806930d3829837de03d8d2f711c29bc630e2d5ad
Sha256 a67b66d1de106cd7a8e67ffdcd90a86120e3ac0e86e386058de5bd4a44a6ab8e
Sha384 1254c5428f9bce5d24b86ce9b78485445953836699fc4df3a9390a41f37e0b6412d0e6fe0e03baf98e1af42ca43193bd
Sha512 a76bd68835334e6bd966adeb8faf89640ff906a319df7f1b476b7bd8459b8e0a1d96a83500961fb518cf1141fd28c5c4598a0066de8ac7b70a9588f000572484
SSDeep 24576:WBsaWLgeX6o7Mvm3OUYUi0PWixQ/I4OkL3BLw6AkQCtK:wsaWLgYbUm3OUYUi0PWIQ/BlOkQCt
TLSH 0355F110B7929D63C47D89F50A23D23097F64F0B6139D2D99CD6BCFBB5E2B482821993
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c51dfc49efea134e52de3e2b2d9cd145
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PharmacyProject.FrmDoktorHastaEkle.resources
button2.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmDoktorRecete.resources
PharmacyProject.FrmEczaneGiris.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmEczaneAna.resources
btnLogin.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button10.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button4.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button5.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button6.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button7.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button9.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmEczaneRecete.resources
$this.Icon
[NBF]root.IconData
PharmacyProject.Properties.Resources.resources
lJvY
[NBF]root.Data
[NBF]root.Data-preview.png
nsh
[NBF]root.Data
Name Value
Module Name
CYPA.exe
Full Name
CYPA.exe
EntryPoint
System.Void PharmacyProject.Program::Main()
Scope Name
CYPA.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CYPA
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1139
Main Method
System.Void PharmacyProject.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void PharmacyProject.FrmAnaGiris::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
CYPA.exe
Full Name
CYPA.exe
EntryPoint
System.Void PharmacyProject.Program::Main()
Scope Name
CYPA.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CYPA
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
1139
Main Method
System.Void PharmacyProject.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void PharmacyProject.FrmAnaGiris::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
CYhuhuhuhu
Embedded Resources UNKNWOWNsuspect
2huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
c51dfc49efea134e52de3e2b2d9cd145
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PharmacyProject.FrmDoktorHastaEkle.resources
button2.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmDoktorRecete.resources
PharmacyProject.FrmEczaneGiris.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmEczaneAna.resources
btnLogin.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button10.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button2.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button4.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button5.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button6.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button7.Image
[NBF]root.Data
[NBF]root.Data-preview.png
button9.Image
[NBF]root.Data
[NBF]root.Data-preview.png
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
PharmacyProject.FrmEczaneRecete.resources
$this.Icon
[NBF]root.IconData
PharmacyProject.Properties.Resources.resources
lJvY
[NBF]root.Data
[NBF]root.Data-preview.png
nsh
[NBF]root.Data
No malware configuration was found at this point.
PDB Path PATH
CYhuhuhuhu
c51dfc49efea134e52de3e2b2d9cd145
Embedded Resources UNKNWOWNsuspect
2huhuhuhu
c51dfc49efea134e52de3e2b2d9cd145
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
c51dfc49efea134e52de3e2b2d9cd145
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙