Suspicious
Suspect

e35bf4bd8ed78626b63cb917fb2fd576

PE Executable
MD5: e35bf4bd8ed78626b63cb917fb2fd576
Size: 1.27 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 e35bf4bd8ed78626b63cb917fb2fd576
Sha1 de348334e29485376b4e0f5487faf00184c51349
Sha256 4c3c4e06e9994eded388727f5744c0746b76cb66f49efc0113111c7e6f975802
Sha384 af41c63a50daf9393e4ba0f12fb63859f7324ada9d91e005b319ace6f28ca0df5584ead67bd74299008897ebf331f7c4
Sha512 24e0f5358f18bed99b96558c85a14881c2076972b645f26f3e9e5a7d43f8aeb21d093a64597a9b0bb6aa45b48cb8c6552e0e7e351962a359d789f2daedcd9064
SSDeep 24576:/klFxzjP/2oSdv/ynygaK1aQmzFtPdYfTWcv4u2QXMixvMFky4Eip:SNb/2oSQnyzDzFtPdqTWcAuNZxvMGy
TLSH A145AD583211EC9EC4928971C9E0DDFAA6302CA7D616E20395E73D9FB93D586EF101E3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e35bf4bd8ed78626b63cb917fb2fd576
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HydroReservoir.ParentForm.resources
HydroReservoir.Properties.Resources.resources
Pro
[NBF]root.Data
WCSe
[NBF]root.Data
[NBF]root.Data-preview.png
HydroReservoir.RelatioForm.resources
$this.Icon
[NBF]root.IconData
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
QnIy.exe
Full Name
QnIy.exe
EntryPoint
System.Void HydroReservoir.Program::Main()
Scope Name
QnIy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
QnIy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
395
Main Method
System.Void HydroReservoir.Program::Main()
Main IL Instruction Count
55
Main IL 
nop <null>
ldc.i4 -154653753
ldc.i4 -709968010
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.8 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B2: ret
ldc.i4.0 <null>
call System.Void HydroReservoir.Program::‎‍‭‪‍‏‏‌‭‍‮‬‎‮‭‪‭‮‮‫‬‬‏‮‎​​​‮(System.Boolean)
ldloc.0 <null>
ldc.i4 -1889846562
mul <null>
ldc.i4 445264121
xor <null>
br.s IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 382636720
mul <null>
ldc.i4 -1006345878
xor <null>
br.s IL_0006: ldc.i4 -709968010
call System.Void HydroReservoir.Program::‬‭‪‎‏‍‌​‮‮​‭‎‬‍‬‏‍‪‭‬​‪‭​‌‮()
ldloc.0 <null>
ldc.i4 -1347511583
mul <null>
ldc.i4 448557284
xor <null>
br.s IL_0006: ldc.i4 -709968010
newobj System.Void HydroReservoir.ParentForm::.ctor()
call System.Void HydroReservoir.Program::​‭‮‎‪‎‌‎‌‏​‏‮‭​‬‏‭‬‭‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -455482015
mul <null>
ldc.i4 1414402004
xor <null>
br IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 -1510982888
mul <null>
ldc.i4 -1939777240
xor <null>
br IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 1086765315
mul <null>
ldc.i4 172024563
xor <null>
br IL_0006: ldc.i4 -709968010
ret <null>
Module Name
QnIy.exe
Full Name
QnIy.exe
EntryPoint
System.Void HydroReservoir.Program::Main()
Scope Name
QnIy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
QnIy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
395
Main Method
System.Void HydroReservoir.Program::Main()
Main IL Instruction Count
55
Main IL 
nop <null>
ldc.i4 -154653753
ldc.i4 -709968010
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.8 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B2: ret
ldc.i4.0 <null>
call System.Void HydroReservoir.Program::‎‍‭‪‍‏‏‌‭‍‮‬‎‮‭‪‭‮‮‫‬‬‏‮‎​​​‮(System.Boolean)
ldloc.0 <null>
ldc.i4 -1889846562
mul <null>
ldc.i4 445264121
xor <null>
br.s IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 382636720
mul <null>
ldc.i4 -1006345878
xor <null>
br.s IL_0006: ldc.i4 -709968010
call System.Void HydroReservoir.Program::‬‭‪‎‏‍‌​‮‮​‭‎‬‍‬‏‍‪‭‬​‪‭​‌‮()
ldloc.0 <null>
ldc.i4 -1347511583
mul <null>
ldc.i4 448557284
xor <null>
br.s IL_0006: ldc.i4 -709968010
newobj System.Void HydroReservoir.ParentForm::.ctor()
call System.Void HydroReservoir.Program::​‭‮‎‪‎‌‎‌‏​‏‮‭​‬‏‭‬‭‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -455482015
mul <null>
ldc.i4 1414402004
xor <null>
br IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 -1510982888
mul <null>
ldc.i4 -1939777240
xor <null>
br IL_0006: ldc.i4 -709968010
nop <null>
ldloc.0 <null>
ldc.i4 1086765315
mul <null>
ldc.i4 172024563
xor <null>
br IL_0006: ldc.i4 -709968010
ret <null>
e35bf4bd8ed78626b63cb917fb2fd576
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HydroReservoir.ParentForm.resources
HydroReservoir.Properties.Resources.resources
Pro
[NBF]root.Data
WCSe
[NBF]root.Data
[NBF]root.Data-preview.png
HydroReservoir.RelatioForm.resources
$this.Icon
[NBF]root.IconData
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙