Suspicious
Suspect

23dc06a0ebbed92a832786f07b9ec139

PE Executable
MD5: 23dc06a0ebbed92a832786f07b9ec139
Size: 1.11 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 14 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270
MD5
23dc06a0ebbed92a832786f07b9ec139
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.11 MB · 1,107,456 B
First seen
2026-10-14 16:30 · 15 days ago
Last seen
2026-10-14 16:30 · 15 days ago
Last analysis
2026-10-14 16:32 · 15 days ago
Hashes
MD5 23dc06a0ebbed92a832786f07b9ec139 Sha1 ce27f64e397c7baf3fb41e9d416cd06d8c9aa028 Sha256 c0bf4b3795ac1bd8c9f0874c35308955b48861d6320145a86d8460dcd064f270 Sha384 d30d437d07c0e30b73a018a6fe4547b6bc68df4c5b2bf45b5bde4cb8c77484f14456d14e22d0eaf432c4fe98730e2f14 Sha512 82fc3d63e2654ad2cf3c3c13a5423e55862499daeed4a4d5f2a1f6cdbfc9dbafeeccf837a82e5f6d087fdb44f1352c1a1162561c015db4df2b9cc0a6db6db8f0 SSDeep 24576:JJQWRkcOUCv7a/mJAuhzZA7eHxQ2TuHLWr4E:fbFNO7yuxieHxQ24E TLSH 12357D5B3D00F58EC4868AB3C9549CFC95112C5EFFC6D203989F3D9AFABD5869E041A2
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High

15 files
EXE23dc06a0ebbed92a832786f07b9ec139
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINPigeonLoft.FormulaireColombier.resources
BINPigeonLoft.Properties.Resources.resources
BINGUI
DATA[NBF]root.Data
BINoWac
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINPigeonLoft.FormulaireRapport.resources
ICON$this.Icon
BIN[NBF]root.IconData
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
zUAs.exe
Full Name
zUAs.exe
EntryPoint
System.Void PigeonLoft.ProgrammePrincipal::Main()
Scope Name
zUAs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zUAs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1
Main Method
System.Void PigeonLoft.ProgrammePrincipal::Main()
Main IL Instruction Count
31
Main IL 
nop <null>
call System.Void PigeonLoft.ProgrammePrincipal::‬‮‎‪‌​‌‬‬‭‪‪‬‪‏‬‎‏‬‎‬‮‍‮()
nop <null>
ldc.i4 924047806
ldc.i4 693124443
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005D: ret
ldc.i4.0 <null>
call System.Void PigeonLoft.ProgrammePrincipal::‭‭​‭‬‏‬​‮‪‭‍‏‍‮‏‬‪‫‭‍‍‮(System.Boolean)
nop <null>
newobj System.Void PigeonLoft.FormulaireColombier::.ctor()
call System.Void PigeonLoft.ProgrammePrincipal::‎‫‌‬‫​‬‍‭​‭‬‮‍‏‬‏‏‎‌‪‫‎‎‫‫‎‬‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -2050936547
mul <null>
ldc.i4 -51900083
xor <null>
br.s IL_000C: ldc.i4 693124443
nop <null>
ldloc.0 <null>
ldc.i4 1272912087
mul <null>
ldc.i4 -1897421280
xor <null>
br.s IL_000C: ldc.i4 693124443
ret <null>
Module Name
zUAs.exe
Full Name
zUAs.exe
EntryPoint
System.Void PigeonLoft.ProgrammePrincipal::Main()
Scope Name
zUAs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zUAs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
1
Main Method
System.Void PigeonLoft.ProgrammePrincipal::Main()
Main IL Instruction Count
31
Main IL 
nop <null>
call System.Void PigeonLoft.ProgrammePrincipal::‬‮‎‪‌​‌‬‬‭‪‪‬‪‏‬‎‏‬‎‬‮‍‮()
nop <null>
ldc.i4 924047806
ldc.i4 693124443
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005D: ret
ldc.i4.0 <null>
call System.Void PigeonLoft.ProgrammePrincipal::‭‭​‭‬‏‬​‮‪‭‍‏‍‮‏‬‪‫‭‍‍‮(System.Boolean)
nop <null>
newobj System.Void PigeonLoft.FormulaireColombier::.ctor()
call System.Void PigeonLoft.ProgrammePrincipal::‎‫‌‬‫​‬‍‭​‭‬‮‍‏‬‏‏‎‌‪‫‎‎‫‫‎‬‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -2050936547
mul <null>
ldc.i4 -51900083
xor <null>
br.s IL_000C: ldc.i4 693124443
nop <null>
ldloc.0 <null>
ldc.i4 1272912087
mul <null>
ldc.i4 -1897421280
xor <null>
br.s IL_000C: ldc.i4 693124443
ret <null>

15 files
EXE23dc06a0ebbed92a832786f07b9ec139
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙