Suspicious
Suspect

PE Executable
MD5: f578ffa05a1819048057042d032c127f
Size: 953.35 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 f578ffa05a1819048057042d032c127f
Sha1 b831b2a5d38e0b876f54ea747db442ba15cd2cec
Sha256 576ac760ec2be7d545c01b834dfa888a824f54fc8d68518a64a198e8c30a29aa
Sha384 15d50beaa864ca8538faae76f6e4c402d09a6c3bdd86c45d272724bf49ae7ebfa96820976927484f3f769a0f3c8d97d9
Sha512 72d79dd5b6aa7a02eb0a2ab07f6158f4e1a44be426f25a77f434716eff87a907603d1c80f7028ac9ec6bd52f9026cf963ff7cd4f263839a8a3b6352c27cfa69e
SSDeep 24576:G2Ni5ZMhM21OvP+V5UK1suCM/MnD1xVD15Eokc3GRH1h:lI5ADkIbeu8RxVZ5Eo3Gfh
TLSH E61523413A69CA57E0ADBB750534E3300335AFDEE901E29E5FEEFC4B34A67D05A00696
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f578ffa05a1819048057042d032c127f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NotepadPlus.Properties.Resources.resources
PIP
[NBF]root.Data
grass
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile_2
[NBF]root.Data
[NBF]root.Data-preview.png
t1
[NBF]root.Data
[NBF]root.Data-preview.png
uPCJ
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
eTus.exe
Full Name
eTus.exe
EntryPoint
System.Void NotepadPlus.Program::Main(System.String[])
Scope Name
eTus.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eTus
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
203
Main Method
System.Void NotepadPlus.Program::Main(System.String[])
Main IL Instruction Count
52
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NotepadPlus.MainForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0060: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_005F: nop
nop <null>
nop <null>
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void NotepadPlus.MainForm::OpenFile(System.String)
nop <null>
nop <null>
leave.s IL_005E: nop
stloc.s ex
nop <null>
ldstr Error opening file: 
ldloc.s ex
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr NotepadPlus
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_005E: nop
nop <null>
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
eTus.exe
Full Name
eTus.exe
EntryPoint
System.Void NotepadPlus.Program::Main(System.String[])
Scope Name
eTus.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eTus
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
203
Main Method
System.Void NotepadPlus.Program::Main(System.String[])
Main IL Instruction Count
52
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NotepadPlus.MainForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldlen <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0060: ldloc.0
nop <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_005F: nop
nop <null>
nop <null>
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void NotepadPlus.MainForm::OpenFile(System.String)
nop <null>
nop <null>
leave.s IL_005E: nop
stloc.s ex
nop <null>
ldstr Error opening file: 
ldloc.s ex
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr NotepadPlus
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_005E: nop
nop <null>
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
PDB Path PATH
eThuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f578ffa05a1819048057042d032c127f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
NotepadPlus.Properties.Resources.resources
PIP
[NBF]root.Data
grass
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile
[NBF]root.Data
[NBF]root.Data-preview.png
grass_tile_2
[NBF]root.Data
[NBF]root.Data-preview.png
t1
[NBF]root.Data
[NBF]root.Data-preview.png
uPCJ
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
PDB Path PATH
eThuhuhuhu
f578ffa05a1819048057042d032c127f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙