Deep Malware Analysis of fa79e7e18d6428470d7a305d54ff6347 | md5: fa79e7e18d6428470d7a305d54ff6347 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.23

PE Executable

MD5: fa79e7e18d6428470d7a305d54ff6347

Size: 503.3 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	fa79e7e18d6428470d7a305d54ff6347
Sha1	5c896f076d94f1adf048329cca92c99a7881b2ec
Sha256	86a4c83d0629495fbfbbcd6df608209d5d873d18e2705dd6dcbca013774f3747
Sha384	6ae7f1f85e9a92acd8e789758fafa3cf54e4ad8a2f3fe6726d59d0482c7a4445a052a90851ed9e9b76f7c83dbefda309
Sha512	111d8c1f50f031dc52953ca6435bf444ee03fc97d7c66204b03ba8786abc154adfe34ef15fb7e21c31bafecc135b5ab733d464c66a35ac9646ec4d39d2f99d68
SSDeep	12288:ykyx6XYT0ibP9LpJwxqv1DIwoc+e8dahxftczi14CqnIXZkR:D9XaxbP9Oq9Qc+hahxftf14DIU
TLSH	F9B412855B99EE00C9B61B7166B2C2757FF13EAAA812D7125FE42DFF78B17045280383

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x77800 size 13832 bytes
Info	PDB Path: CcZf.pdb
Module Name	CcZf.exe
Full Name	CcZf.exe
EntryPoint	System.Void CalculatorPlus.Program::Main()
Scope Name	CcZf.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	CcZf
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	271
Main Method	System.Void CalculatorPlus.Program::Main()
Main IL Instruction Count	10
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void CalculatorPlus.MainForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.