Suspicious
Suspect

PE Executable
MD5: dd2481eb2dcec5163db6d7170d7a5a90
Size: 925.18 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 dd2481eb2dcec5163db6d7170d7a5a90
Sha1 6272f1eeafc0ea46bb1bb1ca4663cd5417f732a0
Sha256 6f9e7f2f753573b0f2686c72dfb4bd2c174cb5ae9e435f36bb9f4b87145df44a
Sha384 9c318d05e3ac41e41944a6c11258328f1382265bdc0ca8d903cacd725e170828f960fde04bbab9c88d91bbc0299a82cb
Sha512 139068f149c1dec8e7f4e5810400ebe90dd6d892e167e7b697ef0b7a39d85372c900b7a4e7284ba5fb9859cf77117242e066cc01049ff84d480118b7bf63c5bc
SSDeep 24576:Rl03HeqVv34fQe0a1ST2IkDh/N5XfR4MgTLG0H:iv4fQe312klDPRP0
TLSH 2C158913372CE49EC91506B10930FBE137A9D9673513FC497AD5E9AFA8A1AC085C23E7
dd2481eb2dcec5163db6d7170d7a5a90
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Сапёр.Main.resources
$this.Icon
[NBF]root.IconData
GameTimer.TrayLocation
LPP
[NBF]root.Data
SettingsButton.Image
[NBF]root.Data
[NBF]root.Data-preview.png
SmileButton.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Сапёр.Properties.Resources.resources
OHUn
[NBF]root.Data
[NBF]root.Data-preview.png
blank_block
[NBF]root.Data
[NBF]root.Data-preview.png
block_1
[NBF]root.Data
[NBF]root.Data-preview.png
block_2
[NBF]root.Data
[NBF]root.Data-preview.png
block_3
[NBF]root.Data
[NBF]root.Data-preview.png
block_4
[NBF]root.Data
[NBF]root.Data-preview.png
block_5
[NBF]root.Data
[NBF]root.Data-preview.png
block_6
[NBF]root.Data
[NBF]root.Data-preview.png
block_7
[NBF]root.Data
[NBF]root.Data-preview.png
block_8
[NBF]root.Data
[NBF]root.Data-preview.png
clicked_bomb_block
[NBF]root.Data
[NBF]root.Data-preview.png
close_button
[NBF]root.Data
[NBF]root.Data-preview.png
close_button_hover
[NBF]root.Data
[NBF]root.Data-preview.png
closed_block
[NBF]root.Data
[NBF]root.Data-preview.png
flagged_block
[NBF]root.Data
[NBF]root.Data-preview.png
minimize_button
minimize_button_hover
not_clicked_bomb_block
[NBF]root.Data
[NBF]root.Data-preview.png
not_flagged_block
[NBF]root.Data
[NBF]root.Data-preview.png
settings
[NBF]root.Data
[NBF]root.Data-preview.png
settings_hover
[NBF]root.Data
[NBF]root.Data-preview.png
smile
[NBF]root.Data
[NBF]root.Data-preview.png
smile_click
[NBF]root.Data
[NBF]root.Data-preview.png
smile_cool
[NBF]root.Data
[NBF]root.Data-preview.png
smile_sad
[NBF]root.Data
[NBF]root.Data-preview.png
Сапёр.Settings.resources
Name Value
Module Name
TPvI.exe
Full Name
TPvI.exe
EntryPoint
System.Void Сапёр.Program::Main()
Scope Name
TPvI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
TPvI
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
237
Main Method
System.Void Сапёр.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Сапёр.Main::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
dd2481eb2dcec5163db6d7170d7a5a90
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Сапёр.Main.resources
$this.Icon
[NBF]root.IconData
GameTimer.TrayLocation
LPP
[NBF]root.Data
SettingsButton.Image
[NBF]root.Data
[NBF]root.Data-preview.png
SmileButton.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Сапёр.Properties.Resources.resources
OHUn
[NBF]root.Data
[NBF]root.Data-preview.png
blank_block
[NBF]root.Data
[NBF]root.Data-preview.png
block_1
[NBF]root.Data
[NBF]root.Data-preview.png
block_2
[NBF]root.Data
[NBF]root.Data-preview.png
block_3
[NBF]root.Data
[NBF]root.Data-preview.png
block_4
[NBF]root.Data
[NBF]root.Data-preview.png
block_5
[NBF]root.Data
[NBF]root.Data-preview.png
block_6
[NBF]root.Data
[NBF]root.Data-preview.png
block_7
[NBF]root.Data
[NBF]root.Data-preview.png
block_8
[NBF]root.Data
[NBF]root.Data-preview.png
clicked_bomb_block
[NBF]root.Data
[NBF]root.Data-preview.png
close_button
[NBF]root.Data
[NBF]root.Data-preview.png
close_button_hover
[NBF]root.Data
[NBF]root.Data-preview.png
closed_block
[NBF]root.Data
[NBF]root.Data-preview.png
flagged_block
[NBF]root.Data
[NBF]root.Data-preview.png
minimize_button
minimize_button_hover
not_clicked_bomb_block
[NBF]root.Data
[NBF]root.Data-preview.png
not_flagged_block
[NBF]root.Data
[NBF]root.Data-preview.png
settings
[NBF]root.Data
[NBF]root.Data-preview.png
settings_hover
[NBF]root.Data
[NBF]root.Data-preview.png
smile
[NBF]root.Data
[NBF]root.Data-preview.png
smile_click
[NBF]root.Data
[NBF]root.Data-preview.png
smile_cool
[NBF]root.Data
[NBF]root.Data-preview.png
smile_sad
[NBF]root.Data
[NBF]root.Data-preview.png
Сапёр.Settings.resources
No malware configuration was found at this point.
PDB Path PATH
?huhuhuhu
dd2481eb2dcec5163db6d7170d7a5a90
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙