Suspicious
Suspect

c5cd78f76895893cb0087bf0b1a511bc

PE Executable
|
MD5: c5cd78f76895893cb0087bf0b1a511bc
|
Size: 728.58 KB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
Hash Value
MD5
c5cd78f76895893cb0087bf0b1a511bc
Sha1
a07f3815ff81997aec0f58536edb1db01e9df732
Sha256
52f7d9e48e3bd296430db88b98ee848e1d5daec114c1f2afce6d1220a89e2914
Sha384
c7eeb5e69e88d80ec29603f94b5b6d89be6cde1e4112fba899f3e103626f0b54e9dca90ff62b882dd20cbeab00ec0700
Sha512
251ba304d1c4482284c578fa6267d60e8b9c059ac4329f2624f2a3124ddf8e7798308ac6456361b198d089dd00348c065a2e14a98993059a915144887ff8cc66
SSDeep
12288:FsT/3plPOgbfp2z3PB8HoRmSFpHs+q2tGW39vDu0edAGnQnX7PuNKS1ZAkR:Fsb5lPOeh2zRA0/LGW404BnImNKkn
TLSH
B5F40218354ADF02C9A64BB20A76D2B027B16E8D6621C70F9FDA3DEF7D62741170076B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HTA_pharmacy.Form1.resources
HTA_pharmacy.Form3.resources
$this.AutoScaleDimensions
$this.ClientSize
$this.Margin
button1.Font
button1.Location
button1.Size
button2.Font
button2.Location
button3.Location
button3.Size
button4.Location
button4.Size
button5.Location
button6.Location
dataGridView1.Location
dataGridView1.Size
dateTimePicker1.Location
dateTimePicker1.Size
label1.Location
label1.Size
label3.Location
label3.Size
label4.Location
label4.Size
textBox1.Location
textBox1.Size
textBox2.Location
HTA_pharmacy.Properties.Resources.resources
MR
[NBF]root.Data
qbmm
[NBF]root.Data
[NBF]root.Data-preview.png
Informations
Name
Value
Module Name

LAHZ.exe

Full Name

LAHZ.exe

EntryPoint

System.Void HTA_pharmacy.Program::Main()

Scope Name

LAHZ.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

LAHZ

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

351

Main Method

System.Void HTA_pharmacy.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void HTA_pharmacy.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

LAHZ.exe

Full Name

LAHZ.exe

EntryPoint

System.Void HTA_pharmacy.Program::Main()

Scope Name

LAHZ.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

LAHZ

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

351

Main Method

System.Void HTA_pharmacy.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void HTA_pharmacy.Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Artefacts
Name
Value
PDB Path

LAHZ.pdb

c5cd78f76895893cb0087bf0b1a511bc (728.58 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙