Suspicious
Suspect

PE Executable
MD5: ff7b44bbca40e27e370d0657c6715029
Size: 762.37 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 ff7b44bbca40e27e370d0657c6715029
Sha1 5e5d4a9bd2c55d8f9fb895a202385b2158f517f4
Sha256 32343ec3ac8ba2e51dc218f39d0e559922bfdc80d59f33c25fa8a48ed8563c5d
Sha384 b99f92d272e06d7d0436b8e4c2357e8bf6509c272bbfeefee014b8fb8431edf32c9adec32e0d742481049e7fcd2782d8
Sha512 c1fafc1e0bfaf79fdbafef50382309917d8947960e3cba4e03e8c2cfe191b7912a082a200b576e177fb4bba28ed4bbc6251734d2d122b58ec7e1f4ca90b7dc9d
SSDeep 12288:0ntaO83acuUKSh5/XNnOPI3AL2PCRwUQCmJgp4l6yyBzmXm5VzhEAEt:0taV3a5UhnOgPP/U1p65yB6m5fEAE
TLSH 35F401452399F901E1F28BF44970E7B013B8AD8EAD26C20A9EF5ACFB78347506D55393
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ff7b44bbca40e27e370d0657c6715029
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HTMLValidator.Forms.MainForm.resources
HTMLValidator.Properties.Resources.resources
SFXO
[NBF]root.Data
[NBF]root.Data-preview.png
dr
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: xLVq.pdb
Module Name
xLVq.exe
Full Name
xLVq.exe
EntryPoint
System.Void HTMLValidator.Program::Main()
Scope Name
xLVq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xLVq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
364
Main Method
System.Void HTMLValidator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void HTMLValidator.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
xLVq.exe
Full Name
xLVq.exe
EntryPoint
System.Void HTMLValidator.Program::Main()
Scope Name
xLVq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xLVq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
364
Main Method
System.Void HTMLValidator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void HTMLValidator.Forms.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ff7b44bbca40e27e370d0657c6715029
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
HTMLValidator.Forms.MainForm.resources
HTMLValidator.Properties.Resources.resources
SFXO
[NBF]root.Data
[NBF]root.Data-preview.png
dr
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙