Suspicious
Suspect

12b26a18dabbfa97168806c97ddbee95

PE Executable
MD5: 12b26a18dabbfa97168806c97ddbee95
Size: 1.18 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 112 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
ca647b807e361ae45b779254dc17251364552d77ab354c90fdd73803ac5bca80
MD5
12b26a18dabbfa97168806c97ddbee95
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/ca647b807e361ae45b779254dc17251364552d77ab354c90fdd73803ac5bca80

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.18 MB · 1,180,672 B
First seen
2026-10-19 08:01 · 12 days ago
Last seen
2026-10-19 08:01 · 12 days ago
Last analysis
2026-10-19 08:02 · 12 days ago
Hashes
MD5 12b26a18dabbfa97168806c97ddbee95 Sha1 e8f073e4b0e332c4e8824455c54c9178496dd400 Sha256 ca647b807e361ae45b779254dc17251364552d77ab354c90fdd73803ac5bca80 Sha384 115b648d8d7c59d2d1474240c69ad814e48c8421b235bde4f014dc3c5cc543071b2736574609a86fc549969f8598367a Sha512 fcec231c600ca2e3352c0e0dc05cf2d1b7dbee2bcc0d5957db1ada4c6cd00270da55f61c5065b18dc03869d705a82d52f7acb46193a3cc3adf5f23a757b99bf3 SSDeep 24576:hKo5CY5NN6Kb2LA9+Lsu7VPK74tLFNPkvxBF:so5vsKqA9ks3Etvqf TLSH 0D45DF64366CAD17CA3956F50A71E53407B92E9A242EE6CE0DD6BDDF7DE0F004E00A93
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

113 files
EXE12b26a18dabbfa97168806c97ddbee95
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINQL_QuanCaPhe.ChiTietHD.resources
BINQL_QuanCaPhe.DangNhap.resources
BINTissue
DATA[NBF]root.Data
BINbtn_DangNhap.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBox1.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBox2.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBox3.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINQL_QuanCaPhe.DoiMatKhau.resources
BINbtn_Doi.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBox1.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINQL_QuanCaPhe.HoaDon.resources
BINbtn_XemCT.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_Xoa.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINquayLạiToolStripMenuItem.Image
IMG[NBF]root.Data
BINtoolStripDropDownButton_TK.Image
IMG[NBF]root.Data
BINQL_QuanCaPhe.KhachHang.resources
BINbtn_Luu.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_Reset.Image
IMG[NBF]root.Data
BINbtn_Sua.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_Them.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_TimKiem.Image
IMG[NBF]root.Data
BINtoolStripDropDownButton_TK.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINQL_QuanCaPhe.NhanVien.resources
BINbtn_TaiAnh.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINpictureBox1.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtoolStripDropDownButton_TK.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINQL_QuanCaPhe.Order.resources
BINbtn_Reset.Image
IMG[NBF]root.Data
BINbtn_Sua.Image
IMG[NBF]root.Data
BINbtn_ThanhToan.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_Them.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbtn_TimKiem.Image
IMG[NBF]root.Data
BINpictureBox1.Image
IMG[NBF]root.Data
BINpictureBox2.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINsảnPhẩmToolStripMenuItem.Image
IMG[NBF]root.Data
BINthôngTinCáNhânToolStripMenuItem.Image
IMG[NBF]root.Data
BINtoolStripDropDownButton_QL.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtoolStripDropDownButton_TK.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINtàiKhoảnToolStripMenuItem.Image
IMG[NBF]root.Data
BINđăngXuấtToolStripMenuItem.Image
IMG[NBF]root.Data
BINđổiMậtKhẩuToolStripMenuItem.Image
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINQL_QuanCaPhe.Properties.Resources.resources
BINoqWZ
DATA[NBF]root.Data
BINQL_QuanCaPhe.SanPham.resources
BINpictureBox1.Image
IMG[NBF]root.Data
BINtoolStripDropDownButton_TK.Image
IMG[NBF]root.Data
BINQL_QuanCaPhe.TaiKhoan.resources
BINQL_QuanCaPhe.ThemKH.resources
BINQL_QuanCaPhe.ThongTinNV.resources
BINQL_QuanCaPhe.XuatHD.resources
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Module Name
oXhk.exe
Full Name
oXhk.exe
EntryPoint
System.Void QL_QuanCaPhe.Program::Main()
Scope Name
oXhk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
oXhk
Assembly Version
3.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1438
Main Method
System.Void QL_QuanCaPhe.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QL_QuanCaPhe.DangNhap::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
oXhk.exe
Full Name
oXhk.exe
EntryPoint
System.Void QL_QuanCaPhe.Program::Main()
Scope Name
oXhk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
oXhk
Assembly Version
3.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1438
Main Method
System.Void QL_QuanCaPhe.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void QL_QuanCaPhe.DangNhap::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

113 files
EXE12b26a18dabbfa97168806c97ddbee95
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙