Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: ede4c6f87901cfa819cd0f5bc4e1fb20
Size: 551.94 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 ede4c6f87901cfa819cd0f5bc4e1fb20
Sha1 705ed6c8fdf814849ddd4cde5ffd712dad1ec6ff
Sha256 3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
Sha384 34fc9d7fbdd0f1bf0c7e0f96e64f489cfb5c8acc0a6d504d8bdf02da836de34c7d91e7675aff180836e938caab33c2c6
Sha512 7fc7f6871becc257a85840c4622b8cbaf93d2cc60b437752110ab459befb78f8613c66630d95c44b957bf025071d6e829ef80ad91f838f2350f08e28ee7c031d
SSDeep 12288:KeNXP+unerGZx+LZYgfp5w2bKguRBqz1R1m/6hkR:KMXPfeiZxopaGTu3qn1m/L
TLSH 05C4F064EE63E502F490537303A1E67673695DADA5C0C2B17AF8EECB7A9D7000F63252
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ede4c6f87901cfa819cd0f5bc4e1fb20
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
三鍵反應遊戲.Form1.resources
$this.Icon
[NBF]root.IconData
B6
[NBF]root.Data
countDown.TrayLocation
imageList1.TrayLocation
timeDelay.TrayLocation
timerGame.TrayLocation
HoqueLtd.Dashboard.resources
HoqueLtd.Properties.Resources.resources
xjo
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
HPq.exe
Full Name
HPq.exe
EntryPoint
System.Void HoqueLtd.Program::Main()
Scope Name
HPq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HPq
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
169
Main Method
System.Void HoqueLtd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void HoqueLtd.HomePage::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
HPq.exe
Full Name
HPq.exe
EntryPoint
System.Void HoqueLtd.Program::Main()
Scope Name
HPq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
HPq
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
169
Main Method
System.Void HoqueLtd.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void HoqueLtd.HomePage::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
?huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙