Suspicious
Suspect

fc5b1709296bcf8ff97846d5d22ff05a

PE Executable
MD5: fc5b1709296bcf8ff97846d5d22ff05a
Size: 730.11 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 fc5b1709296bcf8ff97846d5d22ff05a
Sha1 d7b1dfad2a3738b3d130933fde4c16551e0ea18f
Sha256 eb2355578fd4ca8325b848618aa1e062b72e13aa38d4bd3fdd57beeac2dd34e2
Sha384 adcfc4ed055d262a1e13d22f98820f298c908df08b8db0dc07388746e2e83fadf7e74f50e6467cf441d4ce23d82189a3
Sha512 f89d7e80aa4640a31e1558616ba7f3b3e5ef18fba4a779c44414979d8c7a19ef2bf37ff52c23f3f3c3b325cb784650ad275824a3a907a5ada0c2843f1d89cd79
SSDeep 12288:1lU+WhdNNG8zZb3LMH+EHhZmmbfJ7ppuYIIMTl+3xCcBULO2Fx0han2mx:1lU+WhdNNDd+2mbfFuXpQhaO273x
TLSH D6F4121122E6D514E4F33F3429B1C3B897BBBE496930D30A5BE87CEF3C62A0159547A2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
fc5b1709296bcf8ff97846d5d22ff05a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
StudyGuide.Properties.Resources.resources
OnRx
[NBF]root.Data
[NBF]root.Data-preview.png
shu
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: eHbY.pdb
Module Name
eHbY.exe
Full Name
eHbY.exe
EntryPoint
System.Void StudyGuide.Program::Main()
Scope Name
eHbY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eHbY
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
101
Main Method
System.Void StudyGuide.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void StudyGuide.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
eHbY.exe
Full Name
eHbY.exe
EntryPoint
System.Void StudyGuide.Program::Main()
Scope Name
eHbY.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eHbY
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
101
Main Method
System.Void StudyGuide.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void StudyGuide.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
fc5b1709296bcf8ff97846d5d22ff05a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
StudyGuide.Properties.Resources.resources
OnRx
[NBF]root.Data
[NBF]root.Data-preview.png
shu
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙