Suspicious
Suspect

e9ba32fed9413061ee035f7b464914f1

PE Executable
MD5: e9ba32fed9413061ee035f7b464914f1
Size: 1.14 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 e9ba32fed9413061ee035f7b464914f1
Sha1 088ae9a85a81e2ba6bcb4f8f133bbf1aee09f172
Sha256 0317391e6f82d4c482d55f13426771f59af2993b8aa0d1244ecf7df1fb05df13
Sha384 90201768e83dc57295d7e83d9fe8a6ffd6e8a10a0a7815ef738f9229299e7f54dccd509b4a3bdf065e8c209c38eac8ea
Sha512 1551e85137024d6023e7af5aec25f2b6a16ece999ef0cd905b2c318a765e0206673a583cb6fa26c9e169b9236861f8aedcd18c4ae187adfdcb143cd54b3fc054
SSDeep 24576:vAAr2gM2WsXulHi+zYHhcJ6o0a5OLJVtDj0VGvf1HO2/:FvJTexi+cCV0a0tcVIfM
TLSH FB350159221ACC07C4921FB51D32F7F41B249E95E902D227AFEABEEFF97D9152801342
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e9ba32fed9413061ee035f7b464914f1
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
efyG
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2
Name Value
Module Name
zjqm.exe
Full Name
zjqm.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
zjqm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zjqm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\NqGyplpjiC\src\obj\Debug\zjqm.pdb
Module Name
zjqm.exe
Full Name
zjqm.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
zjqm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zjqm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
e9ba32fed9413061ee035f7b464914f1
.Net Resources
AdminKütüphane.Login.resources
$this.Icon
[NBF]root.IconData
AdminKütüphane.MainPage.resources
Qube
[NBF]root.Data
AdminKütüphane.Properties.Resources.resources
efyG
[NBF]root.Data
[NBF]root.Data-preview.png
AdminKütüphane.BookListPage.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙