Suspicious
Suspect

PE Executable
MD5: eb07eb5b303360e9c3d9eafd0ee2f5ca
Size: 766.98 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 eb07eb5b303360e9c3d9eafd0ee2f5ca
Sha1 9a6f5ff3eb7c0adc7309114f2fbd6d2b7cf05ca1
Sha256 5a0b5dc86cd2a408434f885be7c44ae25ac4e3b7320da9737119f81183be9dba
Sha384 899909ba5e412c7f7b46a103fe530818514a7867c9f384f8ca32e1077d4478369cc7a6704725578cd0db04538bb02438
Sha512 6a78dbd51dfcf30601d9f3441ff926e515d0bde8ba44dbda1845251ddd9bc4f8fde5becb0f384bff2dcc2e474374ed00003ca2d125f1b877b9e6caad0f29f434
SSDeep 12288:NLUREbGEK9EvRGukxsSdlko14LoHZ+eMOHcilW5j0+m31aqV/1sEAcEMEAmD:C2bGon2Xlko1QWOCAxxm3QqnHA8
TLSH ECF401E1766ACF56D82A47F20975E23013B61E4ED865C60E5ADF7EEB71333022852B13
eb07eb5b303360e9c3d9eafd0ee2f5ca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SlotMachine.SlotDisplay.resources
SlotMachine.Properties.Resources.resources
NH
[NBF]root.Data
klRHXP
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: omaPHu.pdb
Module Name
omaPHu.exe
Full Name
omaPHu.exe
EntryPoint
System.Void SlotMachine.Program::Main()
Scope Name
omaPHu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
omaPHu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
374
Main Method
System.Void SlotMachine.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SlotMachine.SlotDisplay::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
eb07eb5b303360e9c3d9eafd0ee2f5ca
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SlotMachine.SlotDisplay.resources
SlotMachine.Properties.Resources.resources
NH
[NBF]root.Data
klRHXP
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙