Suspicious
Suspect

045ca812c7ff164dcb2b8f7f22058800

PE Executable
MD5: 045ca812c7ff164dcb2b8f7f22058800
Size: 144.9 KB
application/x-dosexec

This sample is a 141.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 13 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ce05a292a38bfc0acd84d41f5ab827ddea81b6aee8075e20e4e5f41f50fae82d
MD5
045ca812c7ff164dcb2b8f7f22058800
Verdict
Inconclusive
File type
PE Executable · 141.5 KB

Cite this report: https://app.malva.re/sha256/ce05a292a38bfc0acd84d41f5ab827ddea81b6aee8075e20e4e5f41f50fae82d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
144.9 KB · 144,896 B
First seen
2026-11-02 04:30 · 11 hours ago
Last seen
2026-11-02 04:30 · 11 hours ago
Last analysis
2026-11-02 04:30 · 11 hours ago
Hashes
MD5 045ca812c7ff164dcb2b8f7f22058800 Sha1 021fee8e5c443c4317a853758055b86d953e738c Sha256 ce05a292a38bfc0acd84d41f5ab827ddea81b6aee8075e20e4e5f41f50fae82d Sha384 08896a7b2c9c0641925d780db093e763d8940085d33742abda98013d958a6797ab0c5db0426760019e4ba0c3791fda5f Sha512 8688777d7033816e89e6d18cde2cecd7e1a1f52947c78ff32ae2f43a865051f15fb1d07f986fd6f6523d25f93398f5d01f642f9b5924f86bed6ff2b508abfc3a SSDeep 1536:mei1sMwfiEw3Y0XhMTE9emEuZGgiLOckUSV94LZxUKkk:meiyMwqHI0XSE9epS+/UKkk TLSH 7EE309AA94061724DEF209B581284EFF4FF13E789AB69446B29477EF312E356740C0B7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

14 files
EXE045ca812c7ff164dcb2b8f7f22058800
Structure
BINResources
BINRT_ICON
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINID:0009
BINID:0
BINID:000A
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1

Name Value
Module Name
RntSetup.exe
Full Name
RntSetup.exe
EntryPoint
System.Void RntSetup.Program::Main(System.String[])
Scope Name
RntSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RntSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
64
Main Method
System.Void RntSetup.Program::Main(System.String[])
Main IL Instruction Count
57
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void RntSetup.SetupForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldstr --auto
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
stloc.1 <null>
ldloc.1 <null>
ldc.i4.0 <null>
blt.s IL_006C: ldloc.0
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_006C: ldloc.0
ldarg.0 <null>
ldstr --log
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
stloc.2 <null>
ldloc.0 <null>
ldarg.0 <null>
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
ldarg.0 <null>
ldstr --no-shortcuts
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
ldc.i4.0 <null>
clt <null>
ldloc.2 <null>
ldc.i4.0 <null>
blt.s IL_005F: ldnull
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_0062: ldarg.0
ldnull <null>
br.s IL_0067: callvirt System.Void RntSetup.SetupForm::Auto(System.String,System.Boolean,System.String)
ldarg.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
callvirt System.Void RntSetup.SetupForm::Auto(System.String,System.Boolean,System.String)
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
RntSetup.exe
Full Name
RntSetup.exe
EntryPoint
System.Void RntSetup.Program::Main(System.String[])
Scope Name
RntSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RntSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
64
Main Method
System.Void RntSetup.Program::Main(System.String[])
Main IL Instruction Count
57
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void RntSetup.SetupForm::.ctor()
stloc.0 <null>
ldarg.0 <null>
ldstr --auto
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
stloc.1 <null>
ldloc.1 <null>
ldc.i4.0 <null>
blt.s IL_006C: ldloc.0
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_006C: ldloc.0
ldarg.0 <null>
ldstr --log
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
stloc.2 <null>
ldloc.0 <null>
ldarg.0 <null>
ldloc.1 <null>
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
ldarg.0 <null>
ldstr --no-shortcuts
call System.Int32 System.Array::IndexOf<System.String>(System.String[],System.String)
ldc.i4.0 <null>
clt <null>
ldloc.2 <null>
ldc.i4.0 <null>
blt.s IL_005F: ldnull
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_0062: ldarg.0
ldnull <null>
br.s IL_0067: callvirt System.Void RntSetup.SetupForm::Auto(System.String,System.Boolean,System.String)
ldarg.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
callvirt System.Void RntSetup.SetupForm::Auto(System.String,System.Boolean,System.String)
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

14 files
EXE045ca812c7ff164dcb2b8f7f22058800
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙