Suspicious
Suspect

PE Executable
MD5: f1f30f216e7082600f668dd03f3b475d
Size: 777.22 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 f1f30f216e7082600f668dd03f3b475d
Sha1 73be63cc43ca852cc9e71e5207ecc8dc0426cc4e
Sha256 412fe692b6a79f5f9fa633ea35f902ceaf3c4dadd4c6f186a6efaf34cdc831bd
Sha384 47b0e7fb467d997dc420b76b4805f2cd1525b5d652fd8c5291f9f7cec811e581a6fd67a0fbc24d2201016346dc064212
Sha512 b5248f00d711962f2c12a027a8d089493242e59eb54542741895c8066f324faff453b915094ced3c9ed9c16ebf9c7a392cb5d7d780e8136b48db7a12f81b0042
SSDeep 12288:BU2hPMlJJrkSi5P99e6skVFYsrGqw5B87eSvnH2bO6Z1e6u/x7untvfhIPQvZHz:BU2hPyJdi5P9E6RYsqBBUdewB7wpfyI5
TLSH ECF4026A139ADE12D9E10FF00970D3751379BE8CE422D21B4EFAAEEB78347516850367
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f1f30f216e7082600f668dd03f3b475d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CSS_Minifier.Forms.MainForm.resources
CSS_Minifier.Properties.Resources.resources
CDtc
[NBF]root.Data
[NBF]root.Data-preview.png
crt
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: eLxQ.pdb
Module Name
eLxQ.exe
Full Name
eLxQ.exe
EntryPoint
System.Void CSS_Minifier.Program::Main()
Scope Name
eLxQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eLxQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
385
Main Method
System.Void CSS_Minifier.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CSS_Minifier.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
eLxQ.exe
Full Name
eLxQ.exe
EntryPoint
System.Void CSS_Minifier.Program::Main()
Scope Name
eLxQ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eLxQ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
385
Main Method
System.Void CSS_Minifier.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CSS_Minifier.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
f1f30f216e7082600f668dd03f3b475d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CSS_Minifier.Forms.MainForm.resources
CSS_Minifier.Properties.Resources.resources
CDtc
[NBF]root.Data
[NBF]root.Data-preview.png
crt
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙