Suspicious
Suspect

PE Executable
MD5: 211013cfdb48e16e952f68274de3fd7b
Size: 1.25 MB
application/x-dosexec

This sample is a 1.2 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 19 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa
MD5
211013cfdb48e16e952f68274de3fd7b
Verdict
Inconclusive
File type
PE Executable · 1.2 MB

Cite this report: https://app.malva.re/sha256/1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.25 MB · 1,246,208 B
Hashes
MD5 211013cfdb48e16e952f68274de3fd7b Sha1 9c4c1aed92947d636109717667136b54bd28e2aa Sha256 1583f581b4aed3b58c6dfaa9e8934acb0afbfe12ebc7a5c99ee8757242b4f7fa Sha384 984399ebb5121662e03779c383b513a7b23b1376e2565c9351aea3f43ca84236df05f70eaa06ce70f2b26ed66faea4a9 Sha512 863c1b08d1a77f4cf81468d0e25c334c9b506dede923cf18c8fc50b77b03c3c9d7f017fa0865d9f10772d44c50b7f794d7e49de68ccf55cbb0f2f457944ec067 SSDeep 24576:pZN4BE7DwZOnE3sisdNcJYxJ93jCJH9o:T2ad7isdNjB3Sdo TLSH A34523A061E5CE01E95847B11932D53417BB2C4EE063C21ADFEB7CD73937B91667AB02
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

20 files
EXE211013cfdb48e16e952f68274de3fd7b
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINScientificCalculator.Forms.GraphPlotterForm.resources
BINScientific_Calc.Properties.Resources.resources
BINPIP
DATA[NBF]root.Data
BINUBbI
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINt1
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINt2
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png

Name Value
Module Name
nlsZ.exe
Full Name
nlsZ.exe
EntryPoint
System.Void ScientificCalculator.Program::Main()
Scope Name
nlsZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
nlsZ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
380
Main Method
System.Void ScientificCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ScientificCalculator.Forms.MainCalculatorForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
nlsZ.exe
Full Name
nlsZ.exe
EntryPoint
System.Void ScientificCalculator.Program::Main()
Scope Name
nlsZ.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
nlsZ
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
380
Main Method
System.Void ScientificCalculator.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void ScientificCalculator.Forms.MainCalculatorForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

PDB Path PATH
nlhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

20 files
EXE211013cfdb48e16e952f68274de3fd7b
Structure
No malware configuration was found at this point.

PDB Path PATH
nlhuhuhuhu
211013cfdb48e16e952f68274de3fd7b
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙