d5e82e089ccdf464eb105d94c362a2fe

PE Executable

MD5: d5e82e089ccdf464eb105d94c362a2fe

Size: 1.32 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	d5e82e089ccdf464eb105d94c362a2fe
Sha1	2a66d981dbbe959c81faf021a118a91681af331f
Sha256	d617dcfb7ab25de7be42874328e09164d0e2b5965f7b694541bb6fb15d3cab2a
Sha384	7132a1d334ce5e76ef046d82983bf88e3df4ea2f7ac90b8822a84fc823ff278170289d609ab20c7f8cc9c5afde79f474
Sha512	a12e62085b7d5ce2db27f376deb19341ee452b4bb8bf84d74ed9b0d1e93e075a3db1d0a3a7ee033a3d743c929637d222f0e7aed1b445beca94ed7f2edfbf401b
SSDeep	24576:3dhWLg/ycZCPgaxgaF8qLRW5fKT1YtWA8SoyQy6DYZu3aeCtkQCtK7:NhWLg/Fwgax98qFW5SxQ0fyQxD6u3aBe
TLSH	1855BE8FB21299AFC8E98DF0C512D2F053B14EC96025D1D58CDAA8EBF5E47F4272095B

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	xNwx.exe
Full Name	xNwx.exe
EntryPoint	System.Void PharmacyProject.Program::Main()
Scope Name	xNwx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xNwx
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1139
Main Method	System.Void PharmacyProject.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void PharmacyProject.FrmAnaGiris::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`
Module Name	xNwx.exe
Full Name	xNwx.exe
EntryPoint	System.Void PharmacyProject.Program::Main()
Scope Name	xNwx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	xNwx
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	1139
Main Method	System.Void PharmacyProject.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void PharmacyProject.FrmAnaGiris::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`

PDB Path PATH

xNhuhuhuhu

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

PDB Path PATH

xNhuhuhuhu

d5e82e089ccdf464eb105d94c362a2fe

Embedded Resources UNKNWOWNsuspect

2huhuhuhu

d5e82e089ccdf464eb105d94c362a2fe

Suspicious Type Names (1-2 chars) UNKNWOWN

0huhuhuhu

d5e82e089ccdf464eb105d94c362a2fe

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.