Suspicious
Suspect

PE Executable
MD5: f57b5db44cc79620df566cab6a94fcf6
Size: 903.17 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 f57b5db44cc79620df566cab6a94fcf6
Sha1 b6ea30cd0d192f27ea09e2b1e5db896f740eb34b
Sha256 527faa491b052e081f3f21cc8a1499a895e69184b46fc039b382150f4ee7063e
Sha384 40c3c7812a8d0d41a0d622774d41e5730043cb0086745b5b5924c8d3a18957cd37be1da37cbdee4cb73d4e596fb25da6
Sha512 3f2469772fc0818abc3f9d09c28af2bfc162d7bd8baddfb6e093028cbfe3208e0f2886344728bdffda3d0eb1b75ef2c033e1616fc76dcbeebbbdba962bf41ac7
SSDeep 12288:/kOd7Ux3brQduuaUo+fjIC/90FXlJd4dLhj9d7yuCDkZdo77YI:/ky72YaU/sXlJdY4pknonY
TLSH A215E02027644F12E67A47F54421D13213B89EADB9ADE2456FC2BCCF38B9F815990F63
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f57b5db44cc79620df566cab6a94fcf6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
wmXL
Name Value
Module Name
GACZ.exe
Full Name
GACZ.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
GACZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GACZ
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
GACZ.exe
Full Name
GACZ.exe
EntryPoint
System.Void QLDTDD_FPT.Program::Main()
Scope Name
GACZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GACZ
Assembly Version
5.2.1024.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
998
Main Method
System.Void QLDTDD_FPT.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QLDTDD_FPT.Mainform::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
f57b5db44cc79620df566cab6a94fcf6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
QLDTDD_FPT.AM_Edit.resources
QLDTDD_FPT.Login.resources
$this.Icon
QLDTDD_FPT.Mainform.resources
DF
menuStrip1.TrayLocation
QLDTDD_FPT.Properties.Resources.resources
wmXL
No malware configuration was found at this point.
Embedded Resources UNKNWOWNsuspect
1huhuhuhu
f57b5db44cc79620df566cab6a94fcf6
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
f57b5db44cc79620df566cab6a94fcf6
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙