Suspicious
Suspect

e10e3ce1a6e7a3ac61a81e8d9fefe99c

PE Executable
MD5: e10e3ce1a6e7a3ac61a81e8d9fefe99c
Size: 1.51 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 e10e3ce1a6e7a3ac61a81e8d9fefe99c
Sha1 2aac348628f0f71456bf2f611d6824eba8d39bc0
Sha256 f5bd11a320b37bb5f168cfa868c8d02de0f697ff0c4010e6f7b21f7e847529c9
Sha384 95dec6e4ea8b0f3302329dc44464dcff1a7bfe6d19616dcc25131064e993fb8f156c2105b6287809b9ded59753fd6144
Sha512 ce9e97a078242373ba1ef521f0b121b20efdd59f37b969b6d5f2e736735050f9e18277aadbe0d318b806c68027e60aac7f2a2f64653c1ef687b62cd18414ac93
SSDeep 24576:LrMguQOzmlMYlOS91cA2mwFYxBrlIcdxzWE1szEQP3CJzNbFTq3+GNZqj4RL3rHL:Zu+miaA2mwFYx/FWUsEX5NE3hN+Y3rHL
TLSH E7651260B684AD42D57A2BF509B7D57017B42CADA023D30DA8D7FFEF38A67801069717
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TypingMaster.AboutBox1.resources
TypingMaster.Properties.Resources.resources
Clear
[NBF]root.Data
dfwqeerfdwq
[NBF]root.Data
[NBF]root.Data-preview.png
jNvbP
[NBF]root.Data
[NBF]root.Data-preview.png
werwre
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x16D000 size 13832 bytes
Info
PDB Path: UmcDS.pdb
Module Name
UmcDS.exe
Full Name
UmcDS.exe
EntryPoint
System.Void TypingMaster.Program::Main()
Scope Name
UmcDS.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
UmcDS
Assembly Version
4.0.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
437
Main Method
System.Void TypingMaster.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void TypingMaster.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
UmcDS.exe
Full Name
UmcDS.exe
EntryPoint
System.Void TypingMaster.Program::Main()
Scope Name
UmcDS.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
UmcDS
Assembly Version
4.0.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
437
Main Method
System.Void TypingMaster.Program::Main()
Main IL Instruction Count
10
Main IL
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void TypingMaster.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
[Authenticode]_a32ace3a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TypingMaster.AboutBox1.resources
TypingMaster.Properties.Resources.resources
Clear
[NBF]root.Data
dfwqeerfdwq
[NBF]root.Data
[NBF]root.Data-preview.png
jNvbP
[NBF]root.Data
[NBF]root.Data-preview.png
werwre
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙