Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: f6c255bffe3253d538fca1adbb0ccc60
Size: 790.53 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 f6c255bffe3253d538fca1adbb0ccc60
Sha1 2919235d611bb36611c1c47d53b52521b90d3a8b
Sha256 25e9013b961f8e4e49f65f9f29a08094929adf98c034a4536c871ab576ab5ae5
Sha384 6197b3275a20e93859435e2ab574bc9137a36933ef35c11e823234a6f3a7a207cfb40cc27ab962f736ff06da04837e88
Sha512 266ec5da9a0268eb81ec3ed10caf5e4e5580cb7d6b29fe4b2dea6ae65380ede36a1dc9058aa9608b0f6e1ed4ccced757ab12391aa5186707610050012b1c0434
SSDeep 24576:4z/Tq26QSS2pLoeX7nGY1xBaZsQwuK8XIjaKw:ueLDHnBles1uNIja
TLSH A6F402986B06C903C86A5B385775F27427BC1DEAE811D3074FECEDE7B966F255C08282
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f6c255bffe3253d538fca1adbb0ccc60
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
MeditationTimer.Properties.Resources.resources
AEEP
[NBF]root.Data
[NBF]root.Data-preview.png
Square
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Re
Full Name
Re
EntryPoint
System.Void CLRIKeyValuePairI.ITransportHead::Main()
Scope Name
Re
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vpXh
Assembly Version
5.4.2.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
239
Main Method
System.Void CLRIKeyValuePairI.ITransportHead::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void c.SpecialNameAttrib::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
Re
Full Name
Re
EntryPoint
System.Void CLRIKeyValuePairI.ITransportHead::Main()
Scope Name
Re
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vpXh
Assembly Version
5.4.2.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
239
Main Method
System.Void CLRIKeyValuePairI.ITransportHead::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void c.SpecialNameAttrib::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙