Suspicious
Suspect

0ef11a7596e1ddcf5be57e0b52bacd11

Share on LinkedIn
Print
PE Executable
MD5: 0ef11a7596e1ddcf5be57e0b52bacd11
Size: 777.73 KB
application/x-dosexec

This sample is a 759.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 18 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
b6d03e3f9c178c77eb32e730e8e690fa844ffd73f49a8fa0c6c37ea09956e299
MD5
0ef11a7596e1ddcf5be57e0b52bacd11
Verdict
Inconclusive
File type
PE Executable · 759.5 KB

Cite this report: https://app.malva.re/sha256/b6d03e3f9c178c77eb32e730e8e690fa844ffd73f49a8fa0c6c37ea09956e299

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
777.73 KB · 777,728 B
First seen
2026-10-23 00:30 · 9 days ago
Last seen
2026-10-23 00:30 · 9 days ago
Last analysis
2026-10-23 00:30 · 9 days ago
Hashes
MD5 0ef11a7596e1ddcf5be57e0b52bacd11 Sha1 959700583d893a797c31a05a83338482ca9c2411 Sha256 b6d03e3f9c178c77eb32e730e8e690fa844ffd73f49a8fa0c6c37ea09956e299 Sha384 5443950c58c687c5b5c17d69e6eb8ea778066a89e0cd2325e72fbc563f4046de39d788b70aed30501357cfe679d73a07 Sha512 0ee27df210bbae65c2606d7bf4163b71c0e604033b3565356f4e22bee0b7b0b343dfc022b5cceecf394f917ec972a03b790f311fc1086b41577e5d4c68642960 SSDeep 12288:rDrO5uarElvJ0ig/mWyiaWwMMPqzy+gsXViF0hlDhX+J88oi:PrYqJ0/nQMgqzyPoVphNhX+C8o TLSH 57F402642369F602E9B65FF51A71E334A336AE8DE531D30B8EEA6CDF38257016D44342
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

19 files
EXE0ef11a7596e1ddcf5be57e0b52bacd11
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
mLsI.exe
Full Name
mLsI.exe
EntryPoint
System.Void ReindeerHerdApp.Program::Main()
Scope Name
mLsI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mLsI
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
235
Main Method
System.Void ReindeerHerdApp.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ReindeerHerdApp.TundraForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
mLsI.exe
Full Name
mLsI.exe
EntryPoint
System.Void ReindeerHerdApp.Program::Main()
Scope Name
mLsI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mLsI
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
235
Main Method
System.Void ReindeerHerdApp.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ReindeerHerdApp.TundraForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙