Suspicious
Suspect

PE Executable
MD5: efeac648e34cf17cc09a3c0a0410aa1f
Size: 646.14 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 efeac648e34cf17cc09a3c0a0410aa1f
Sha1 7e274ef56e9d4bbe57e3cb008c3bd1de981feb7a
Sha256 74ace00f731591af315dda87a91dcad538db3fab7a62d9e8612eef59dc128bde
Sha384 4d1c863523f423c73d450d5054837981f5d923c67a3c446156f81b596e5e1b9149766f44965f5377894fc1329016c9e5
Sha512 9057f0a09de7e23f32edc1c69b1f965690e133ae16e8b7c154440c8a03bf4c0ecb4abc1948e81cf22888623eba60ea44b608778411e57b30d791dac5bba93d54
SSDeep 12288:hLURCp7zinGJ/NUFJIZlbPm70Eqy8w5ADrB+3ZUNZBZT:+tiUJ+ljS8qADFSZUNZBZ
TLSH DED4126537A89F33E9765BF12571E13203B90E5BB821D79B8EDAACDF3A127110840B53
efeac648e34cf17cc09a3c0a0410aa1f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SlotMachine.SlotDisplay.resources
SlotMachine.Properties.Resources.resources
IVnZow
[NBF]root.Data
[NBF]root.Data-preview.png
NH
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: thoAXA.pdb
Module Name
thoAXA.exe
Full Name
thoAXA.exe
EntryPoint
System.Void SlotMachine.Program::Main()
Scope Name
thoAXA.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
thoAXA
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
374
Main Method
System.Void SlotMachine.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void SlotMachine.SlotDisplay::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
efeac648e34cf17cc09a3c0a0410aa1f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SlotMachine.SlotDisplay.resources
SlotMachine.Properties.Resources.resources
IVnZow
[NBF]root.Data
[NBF]root.Data-preview.png
NH
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙