Deep Malware Analysis of dfffc9dabcac76d0fa7f5383989fd68f | md5: dfffc9dabcac76d0fa7f5383989fd68f | .Net | PE (Portable Executable) | SOS: 0.31 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	dfffc9dabcac76d0fa7f5383989fd68f
Sha1	bc5140a88277f4db559d4502a7c4524f29ee4afe
Sha256	40018b81b80a0154b5003791d3faf1c38fdf9ae66584c6a95c8aab56cd38ff1d
Sha384	19968bc5cc2a11186418ff6860ce96974597c2f6350579fb3c27143eadb6b576aee6208deb5ffb2646d964f3a7ebf6f0
Sha512	4ccbe7afa3cca3d7f4e9ec2d7238fe4f48c0036238161ad4be7884af320216a06b0977defb1b187b21da7a7c5eafaddc93c76dd46ec946395cf3768f5838c88a
SSDeep	24576:8x3TQkhNbvwhx071dCW0l7Kf5slu79OhQxszqsm:qsgvwTXW0lOGlupOhQxOq3
TLSH	F335E0085146CBA2DC5477B3CA72CEF422B35C9AD193D3EB49F87DEB3A35AB45448242

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Module Name	QnDV.exe
Full Name	QnDV.exe
EntryPoint	System.Void InkWell.Program::Main()
Scope Name	QnDV.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	QnDV
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	378
Main Method	System.Void InkWell.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void InkWell.FormSchreibtisch::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`
Info	PE Detect: PeReader OK (file layout)