Suspicious
Suspect

c714eda54303d9235a46ce4537efc074

PE Executable
MD5: c714eda54303d9235a46ce4537efc074
Size: 1.24 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 c714eda54303d9235a46ce4537efc074
Sha1 17b5a790e2250b4e7a12ae2c0b35cc56103f0910
Sha256 b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c
Sha384 bc70b9c5dac9c469a27d4daefd9c556dfeb933ac136a2dbb6e5bb66c18379f8af397799ba27073ecbc4ce246d8c5a948
Sha512 4d7191bddb61ac099b7e19e65287c51952e52aee4b34d1420d6ddda0d44bcbb5caf63191736512c9e97074b603704bfb2a1d054cbadc679f6a4afe42bc791a7b
SSDeep 24576:XL21q+uS0KBjzt2a1IzFVgZB31PLNqw2Tak+RECk59vIzy2kNRcL:ahuTMv31KXgnFP5eTak+mNjv8y2
TLSH 3D4522063719EA0AC9A05BF51870E17907BE9CDEA522D2172FCA7EEBB975F004C54783
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
UnitConvert.BidirectionalConverterForm.resources
UnitConvert.Properties.Resources.resources
de
[NBF]root.Data
qVTm
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: KvLs.pdb
Module Name
KvLs.exe
Full Name
KvLs.exe
EntryPoint
System.Void UnitConvert.Program::Main()
Scope Name
KvLs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
KvLs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
387
Main Method
System.Void UnitConvert.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void UnitConvert.MainMenuForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
UnitConvert.BidirectionalConverterForm.resources
UnitConvert.Properties.Resources.resources
de
[NBF]root.Data
qVTm
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙