Suspicious
Suspect

2397b29d79b6259e6cf931f6e744fd91

PE Executable
MD5: 2397b29d79b6259e6cf931f6e744fd91
Size: 1.75 MB
application/x-dosexec

This sample is a 1.7 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 18 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
f86ac1d4c78f46aabb5e3d57f949fac4745bfecec1bcd639f1993186bc404cd7
MD5
2397b29d79b6259e6cf931f6e744fd91
Verdict
Inconclusive
File type
PE Executable · 1.7 MB

Cite this report: https://app.malva.re/sha256/f86ac1d4c78f46aabb5e3d57f949fac4745bfecec1bcd639f1993186bc404cd7

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.75 MB · 1,747,968 B
First seen
2026-09-10 10:45 · one month ago
Last seen
2026-09-10 10:45 · one month ago
Last analysis
2026-09-10 10:45 · one month ago
Hashes
MD5 2397b29d79b6259e6cf931f6e744fd91 Sha1 684fef1117c775a8999fbbcd57435252e60062d1 Sha256 f86ac1d4c78f46aabb5e3d57f949fac4745bfecec1bcd639f1993186bc404cd7 Sha384 e7f92655a92a85c6184934b94328d835024cd7d013048ce89ca13c2717b74bc401ee1ace2cf8cf67b67607c589ae7d74 Sha512 1138181498b126042806adcc239d52a97d8327ffd06ecaff769dc09b6dfa7cee4a45fabe47f01bc205fa983164e8b1e71c23f0a419de3f921f7d37f6c37794c6 SSDeep 49152:8C2dkyJ/dp9z2P3Sps4+zaiEFTusBQQCL6j:8C2umrF2PipWEF+a TLSH F385F158261BDB23D55273B1C8B2D2F416749E84E801C23F5AE97DBB7F36F761884282
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

19 files
EXE2397b29d79b6259e6cf931f6e744fd91
Structure
BIN.Net Resources
BINaa.mD.resources
BINfXv.xX2.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINAvalancheSlope.Properties.Resources.resources
BINbQmm
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINKare
DATA[NBF]root.Data
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
esjL.exe
Full Name
esjL.exe
EntryPoint
System.Void Q8.MS::G5()
Scope Name
esjL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
esjL
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
323
Main Method
System.Void Q8.MS::G5()
Main IL Instruction Count
20
Main IL 
br IL_003B: nop
ldloc.s V_0
newobj System.Void aa.mD::.ctor(gk.GQ)
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0039: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_002F: call System.Void dO7.MOL::puw()
nop <null>
newobj System.Void gk.GQ::.ctor()
stloc.s V_0
br IL_0005: ldloc.s V_0
call System.Void dO7.MOL::puw()
br IL_0022: nop
nop <null>
ret <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0016: nop
Module Name
esjL.exe
Full Name
esjL.exe
EntryPoint
System.Void Q8.MS::G5()
Scope Name
esjL.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
esjL
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
323
Main Method
System.Void Q8.MS::G5()
Main IL Instruction Count
20
Main IL 
br IL_003B: nop
ldloc.s V_0
newobj System.Void aa.mD::.ctor(gk.GQ)
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0039: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_002F: call System.Void dO7.MOL::puw()
nop <null>
newobj System.Void gk.GQ::.ctor()
stloc.s V_0
br IL_0005: ldloc.s V_0
call System.Void dO7.MOL::puw()
br IL_0022: nop
nop <null>
ret <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0016: nop

19 files
EXE2397b29d79b6259e6cf931f6e744fd91
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙