Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: f1a584562bde9a0b6814c9bfd5b092b5
Size: 1.15 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f1a584562bde9a0b6814c9bfd5b092b5
Sha1 1594806a529f15b39b687e75f4382a6220a52105
Sha256 3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
Sha384 b32dd5ddb34f01619cf56bf40d10b22d4e0a36cfed3f80378069b9aab00eb4788c300a7606b0bfc48e3bfc3c5cfebca5
Sha512 a13c53bdd9443b447f2af81c9a69868b00d61febac9ead7bf728eb142d953d571eed432db7fc8f6163d0ac042d12ec75f36748b838ba5509503a7300f8913667
SSDeep 24576:qguQ5Y9WeirIjHsQW/qiQRZWqv0JFBI4huyDQqsM6e3C7kNOZgxc:juwnryWyiQ7hvIBXuy0qsM6e3C79Sc
TLSH 73352352339DCE4BD0520BF92271D33053B58D2AE842D267CFEDACDFB916AA12569307
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f1a584562bde9a0b6814c9bfd5b092b5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GratitudeJournal.Form1.resources
GratitudeJournal.Properties.Resources.resources
Clear
[NBF]root.Data
_02
[NBF]root.Data
[NBF]root.Data-preview.png
gUgZtF
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
RegisteredChan
Full Name
RegisteredChan
EntryPoint
System.Void UTF8Deco.SoapIdr::Main()
Scope Name
RegisteredChan
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RyOZjU
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void UTF8Deco.SoapIdr::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void c.TimerQu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
RegisteredChan
Full Name
RegisteredChan
EntryPoint
System.Void UTF8Deco.SoapIdr::Main()
Scope Name
RegisteredChan
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RyOZjU
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
260
Main Method
System.Void UTF8Deco.SoapIdr::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void c.TimerQu::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙