Suspicious
Suspect

PE Executable
MD5: e4f88607b1cd2314700d1a6872a0727d
Size: 869.89 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 e4f88607b1cd2314700d1a6872a0727d
Sha1 a74a5de3a61e5a0ca9069ff883d023e8cd371fd7
Sha256 229143d66574d5d01e18ec3078b0d3de25b91c21dfb79e9f75032a7d8d555f68
Sha384 071176a0080701f4de57a2d75a9c33f9003c2ed96e7c9c6601efa616ceb1668dcf4b477b126ed120bf1783d12fb1f8c5
Sha512 8a0da3a32c648c1b9d879981368a470e88f5745d4fe8ecfc8273f1d3635707b481a2d366fb7d76a16c6418b12d2dad7d2f8d96f050852e5aca73b7056397c804
SSDeep 12288:miX9tGvHSWRGXFtp+k4usO+7QWaFXTqsp5WJHyGJfG2sTOHIxAfqO+/KI4D:VteHRRGrpjre7aI8rGvMolqO+/KI4
TLSH 180501013354DFB7F9EA6F319660D63413A86D0A9CE5D3590ECEBEDB386278148F1A12
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e4f88607b1cd2314700d1a6872a0727d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AlarmPlus.AlarmForm.resources
AlarmPlus.Properties.Resources.resources
Sweet
[NBF]root.Data
geVf
[NBF]root.Data
[NBF]root.Data-preview.png
AlarmPlus.SettingsForm.resources
$this.Icon
[NBF]root.IconData
AlarmPlus.StatisticsForm.resources
$this.Icon
[NBF]root.IconData
Name Value
Module Name
RNAV.exe
Full Name
RNAV.exe
EntryPoint
System.Void AlarmPlus.Program::Main()
Scope Name
RNAV.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RNAV
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
278
Main Method
System.Void AlarmPlus.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AlarmPlus.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
RNAV.exe
Full Name
RNAV.exe
EntryPoint
System.Void AlarmPlus.Program::Main()
Scope Name
RNAV.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RNAV
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
278
Main Method
System.Void AlarmPlus.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AlarmPlus.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
RNhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
e4f88607b1cd2314700d1a6872a0727d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AlarmPlus.AlarmForm.resources
AlarmPlus.Properties.Resources.resources
Sweet
[NBF]root.Data
geVf
[NBF]root.Data
[NBF]root.Data-preview.png
AlarmPlus.SettingsForm.resources
$this.Icon
[NBF]root.IconData
AlarmPlus.StatisticsForm.resources
$this.Icon
[NBF]root.IconData
No malware configuration was found at this point.
PDB Path PATH
RNhuhuhuhu
e4f88607b1cd2314700d1a6872a0727d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙