Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: dfe5c35f3c530beb218c7f294495ca58
Size: 697.86 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 dfe5c35f3c530beb218c7f294495ca58
Sha1 483d4b15dfee5b7cf303bd1bc68040d59b75c73c
Sha256 0871d13ba9d0da576e3347505ea6ebf0b852a32539d5d88ccc1ef06b1978a3f5
Sha384 9a2395b316fbda6974e2def86651f5f7a09871952b9d288aab8b23376752e9533c63a752bdc34c3e4ded87a4c9df1137
Sha512 1f36e883281f1dec1bd0b8ae4d503599039618374b4c6b54f5a8842db97e5a0881de6ad5c9dc10b76d510064ca6321a2a800fe2e5af4e07e389b16c35646cc14
SSDeep 12288:k/no0TRWawyWmEgOwvy1EbMhp5bTIIgtsbevfTQkoYpTUyO+:mo0dWyWHgOeyKbMh/bfzSokTW+
TLSH 18E4F164FD67E902F44867B74761EA7532A94CACA0C1C1B27EF4EEDB78AD6010F63112
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
dfe5c35f3c530beb218c7f294495ca58
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
三鍵反應遊戲.Form1.resources
$this.Icon
[NBF]root.IconData
B6
[NBF]root.Data
countDown.TrayLocation
imageList1.TrayLocation
timeDelay.TrayLocation
timerGame.TrayLocation
HoqueLtd.Dashboard.resources
HoqueLtd.Properties.Resources.resources
UQt
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
ulc.exe
Full Name
ulc.exe
EntryPoint
System.Void HoqueLtd.Program::Main()
Scope Name
ulc.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ulc
Assembly Version
8.10.5.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
169
Main Method
System.Void HoqueLtd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void HoqueLtd.HomePage::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
ulc.exe
Full Name
ulc.exe
EntryPoint
System.Void HoqueLtd.Program::Main()
Scope Name
ulc.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ulc
Assembly Version
8.10.5.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
169
Main Method
System.Void HoqueLtd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void HoqueLtd.HomePage::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙