Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: e3100aa5f3d1d5c99b1a4d719aaa8304
Size: 679.94 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 e3100aa5f3d1d5c99b1a4d719aaa8304
Sha1 9f67e07b51657c1e1f76726778e5fee725ac16ca
Sha256 b2d5d9d3c3bfdca561730af8e3cedf26a7a8863e8ee2b7b2e0b5ea8a1aa19636
Sha384 3f5e3945c8861e6fe9a7887c38f8c7795d1d76ab4f29deb5f7d8d846ff4af46579c4880ef5c710d0ff5f3c9e007a6c15
Sha512 5c398cbc3c779b305089dcb8d009bf2b3f59546ece8c766f2bccabf3765cb4de30df8842165532c103685c479fafcd75b67a47f5a402dca553bdd7e47bf1df4a
SSDeep 12288:d6AC7zOCNTLk9O0O+MBJhDSLnBTFJzf7oqXrme1gpD0cLZqfcIwA/BAplzWaoyP:oA0pLodLLBTQq71gpgcDip9Lk
TLSH 37E412582A91DC22E8E917F488F0D3B912B95ECCF823D30B4FDC6DF7751A6462A54385
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
e3100aa5f3d1d5c99b1a4d719aaa8304
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PharmacyManager.Properties.Resources.resources
gr
[NBF]root.Data
kBeN
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
hieC.exe
Full Name
hieC.exe
EntryPoint
System.Void PharmacyManager.Program::Main()
Scope Name
hieC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hieC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
96
Main Method
System.Void PharmacyManager.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PharmacyManager.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
hieC.exe
Full Name
hieC.exe
EntryPoint
System.Void PharmacyManager.Program::Main()
Scope Name
hieC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hieC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
96
Main Method
System.Void PharmacyManager.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PharmacyManager.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
hihuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙