Suspicious
Suspect

ec322ec84a3c931e706d1db17a4aa426

PE Executable
|
MD5: ec322ec84a3c931e706d1db17a4aa426
|
Size: 1.66 MB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
Hash Value
MD5
ec322ec84a3c931e706d1db17a4aa426
Sha1
1ece0b3b3668b350a00bf57a6498830554e6fc85
Sha256
7e054ed61b913fd63b68efdabb7c2f954e926198881502949484680ee4d04963
Sha384
bd4521c7adf11dc2f3378f0e00de2636e141c41a3d01f42e5169ee2a9eb1ddb1d2f4f68ab5003a948456b944c6cc8c5d
Sha512
8c89e3feabfca2afbca566ff221c1439eb0387676abb9bba1ead465b79f9c5cae44ae6776e803600064efc101f0ecd256a49e697c5593c859bddd37648d02afd
SSDeep
49152:N9fEamo748Z564378PUfT409Q8T/2r4jGY:N9vmWv5r8PUr409Q872r4KY
TLSH
4A75021172A4AF41D57943F91661E73157F21CAFE93AE30A1CC66CEF3878B844D22A93

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
EczaneOtomasyon.AnaMenu.resources
EczaneOtomasyon.Hakkinda.resources
ımageList1.ImageStream
[NBF]root.Data
EczaneOtomasyon.GenelMenu.resources
ımageList1.ImageStream
[NBF]root.Data
EczaneOtomasyon.Properties.Resources.resources
ZlVT
[NBF]root.Data
[NBF]root.Data-preview.png
jj
[NBF]root.Data
EczaneOtomasyon.SaglikArsiv.resources
ımageList1.TrayLocation
Informations
Name
Value
Module Name

wHFT.exe

Full Name

wHFT.exe

EntryPoint

System.Void EczaneOtomasyon.Program::Main()

Scope Name

wHFT.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

wHFT

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

1124

Main Method

System.Void EczaneOtomasyon.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void EczaneOtomasyon.GenelMenu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

wHFT.exe

Full Name

wHFT.exe

EntryPoint

System.Void EczaneOtomasyon.Program::Main()

Scope Name

wHFT.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

wHFT

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

1124

Main Method

System.Void EczaneOtomasyon.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void EczaneOtomasyon.GenelMenu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Artefacts
Name
Value
PDB Path

wHFT.pdb

Embedded Resources

20

Suspicious Type Names (1-2 chars)

0

ec322ec84a3c931e706d1db17a4aa426 (1.66 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙