Suspicious
Suspect

34c0379ada50db2259abed2736d141c3

PE Executable
MD5: 34c0379ada50db2259abed2736d141c3
Size: 1.06 MB
application/x-dosexec

This sample is a 1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 6 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
7328d58846799b41b0e75d8499e817901f595a1baa397c8684b004068e2fda9b
MD5
34c0379ada50db2259abed2736d141c3
Verdict
Inconclusive
File type
PE Executable · 1 MB

Cite this report: https://app.malva.re/sha256/7328d58846799b41b0e75d8499e817901f595a1baa397c8684b004068e2fda9b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.06 MB · 1,062,400 B
First seen
2026-10-14 16:16 · 16 days ago
Last seen
2026-10-14 16:16 · 16 days ago
Last analysis
2026-10-14 16:16 · 16 days ago
Hashes
MD5 34c0379ada50db2259abed2736d141c3 Sha1 1c0f360a192ee3948550157f2d544921687232da Sha256 7328d58846799b41b0e75d8499e817901f595a1baa397c8684b004068e2fda9b Sha384 059d98bf63a8275f9a11994f60d0924bcd612c4cb8c10cfb05e3111a40c01d00abc96bc33a3681b7ecde9d05a80a7d3c Sha512 2bbc673ff57ca2df42a1fce644aba59bd4b2e8e7e36e0ad67655db1827e2f57e203f7341d6588e2bc62090ad62bc0afff09d6412a3639a6e0b16ebb6c99809af SSDeep 24576:cMFNv6KX8dlhdLm2oeMt6fgm1ZfSJ9x7/Ps2vRl:bvSfrD9oMpvfSXx7/UK TLSH DC359EAC3241B99FC417CE768964EE70DA602DA69307D20391E71DEFBD0DA979E041E3
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

7 files
EXE34c0379ada50db2259abed2736d141c3
BIN.Net Resources
BINTidalMill.Properties.Resources.resources
BINKL
DATA[NBF]root.Data
BINklns
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1

Name Value
Module Name
LXXT.exe
Full Name
LXXT.exe
EntryPoint
System.Void TidalMill.Program::Main()
Scope Name
LXXT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LXXT
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void TidalMill.Program::Main()
Main IL Instruction Count
31
Main IL 
nop <null>
call System.Void TidalMill.Program::​‏‭‫‌‌‍‫‎‬‍‪‮‫‌‬‌‪‍‍‬‍‮()
nop <null>
ldc.i4.0 <null>
call System.Void TidalMill.Program::‫‎‏‭‮‪‏‎‌‮‏‏​‪‌‮‎‬‍‎‏‏‮(System.Boolean)
ldc.i4 24668333
ldc.i4 1924526231
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005C: nop
nop <null>
ldloc.0 <null>
ldc.i4 559463380
mul <null>
ldc.i4 -372595162
xor <null>
br.s IL_0012: ldc.i4 1924526231
newobj System.Void TidalMill.FormaGlavna::.ctor()
call System.Void TidalMill.Program::​​​​‬‌‫‪‭‭‮‫‭‍‏‭‪‫‌‍‏‭‮​‍‬‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -1979348251
mul <null>
ldc.i4 -1502204386
xor <null>
br.s IL_0012: ldc.i4 1924526231
nop <null>
ret <null>
Module Name
LXXT.exe
Full Name
LXXT.exe
EntryPoint
System.Void TidalMill.Program::Main()
Scope Name
LXXT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LXXT
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void TidalMill.Program::Main()
Main IL Instruction Count
31
Main IL 
nop <null>
call System.Void TidalMill.Program::​‏‭‫‌‌‍‫‎‬‍‪‮‫‌‬‌‪‍‍‬‍‮()
nop <null>
ldc.i4.0 <null>
call System.Void TidalMill.Program::‫‎‏‭‮‪‏‎‌‮‏‏​‪‌‮‎‬‍‎‏‏‮(System.Boolean)
ldc.i4 24668333
ldc.i4 1924526231
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_005C: nop
nop <null>
ldloc.0 <null>
ldc.i4 559463380
mul <null>
ldc.i4 -372595162
xor <null>
br.s IL_0012: ldc.i4 1924526231
newobj System.Void TidalMill.FormaGlavna::.ctor()
call System.Void TidalMill.Program::​​​​‬‌‫‪‭‭‮‫‭‍‏‭‪‫‌‍‏‭‮​‍‬‮(System.Windows.Forms.Form)
ldloc.0 <null>
ldc.i4 -1979348251
mul <null>
ldc.i4 -1502204386
xor <null>
br.s IL_0012: ldc.i4 1924526231
nop <null>
ret <null>

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

7 files
EXE34c0379ada50db2259abed2736d141c3
No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
34c0379ada50db2259abed2736d141c3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙