Suspicious
Suspect

PE Executable
MD5: e230c1216635c46430ef04a219eb53e8
Size: 716.8 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 e230c1216635c46430ef04a219eb53e8
Sha1 b0ed7bf08e6a0e7241ce48dc99c5034c9c4e9a48
Sha256 004dcf9aaffaca3efa1f6e0019e9205f1344cbef12efd1ed8c17ec3a43ecaee0
Sha384 c58dc49b398c59017161490cd078555a37650a834474152066fa056d5c42d2e76554ea089f77ffc027a4dba4aa97c6ab
Sha512 a1479c66d484e3afcff58ddc8fb14989e1ef7cf4f0694b41c48eb2b381806c7b16779071656d2a302180b10a7a8b4be464d17c158e809f4ceab0f6d31ca6d02b
SSDeep 12288:OFPsLPegp7y+22Yif/5ktYkMmSqBrcQfYmHPEr0K:LeS2XiWambcEYqsoK
TLSH 2CE4120125E69A1AE6F39BB24861D2B803B07EAAB821F7570DD5BDDF7C31F910990307
PeID
UPolyX 0.3 -> delikon
e230c1216635c46430ef04a219eb53e8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
COK
[NBF]root.Data
[NBF]root.Data-preview.png
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
HsV.exe
Full Name
HsV.exe
EntryPoint
System.Void SmartNote.Program::Main()
Scope Name
HsV.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HsV
Assembly Version
3.9.4.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
210
Main Method
System.Void SmartNote.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SmartNote.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
Hshuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e230c1216635c46430ef04a219eb53e8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SmartNote.Properties.Resources.resources
COK
[NBF]root.Data
[NBF]root.Data-preview.png
NA
[NBF]root.Data
Winken_nach_Rechts
[NBF]root.Data
[NBF]root.Data-preview.png
YouTube_Logo
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
Hshuhuhuhu
e230c1216635c46430ef04a219eb53e8
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙