Suspicious
Suspect

3dbcbf0708a3abe17082416cfd1c0fcb

PE Executable
MD5: 3dbcbf0708a3abe17082416cfd1c0fcb
Size: 165.89 KB
application/x-dosexec

This sample is a 162 KB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 2 embedded or derived files. It matches 7 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
0a60d4d3f45698ca0d95301f80386482ab2702b07d2e20bf9eed22919b6587a0
MD5
3dbcbf0708a3abe17082416cfd1c0fcb
Verdict
No known threat found
File type
PE Executable · 162 KB

Cite this report: https://app.malva.re/sha256/0a60d4d3f45698ca0d95301f80386482ab2702b07d2e20bf9eed22919b6587a0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
165.89 KB · 165,888 B
First seen
2026-10-30 00:15 · 4 days ago
Last seen
2026-10-30 00:15 · 4 days ago
Last analysis
2026-10-30 00:15 · 4 days ago
Hashes
MD5 3dbcbf0708a3abe17082416cfd1c0fcb Sha1 6973c0ac3acf5e30547f57d529c2408d5fb13ad8 Sha256 0a60d4d3f45698ca0d95301f80386482ab2702b07d2e20bf9eed22919b6587a0 Sha384 3ce8b6c47d551d8208395a4d9091d8acdaa4ebc495c3b8a78d3782cd6055eec6e569a047f656d62dde5b118922d4f75b Sha512 a1067451590d3aebcda4cc934ad0929a09410146850408a9a404f5994a232b48368d4216bfa4e7e5a590a61daa1c2de176c4d042254b6b673c1f952e9dea89ca SSDeep 3072:fPSzCSFgCL3ICLYSOb3Dkwrxc6fQ6nZktaHQ5SI7jHOl3X:oJFgCL3ICwlc6L85sl TLSH B5F3192E77FC0622F17E877885B201C24635B613B716DB8E58CB69CC08267B176127AF
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

3 files
EXE3dbcbf0708a3abe17082416cfd1c0fcb
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
ZapretGUI.exe
Full Name
ZapretGUI.exe
EntryPoint
System.Int32 ZapretGUI.Program::Main(System.String[])
Scope Name
ZapretGUI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZapretGUI
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1268
Main Method
System.Int32 ZapretGUI.Program::Main(System.String[])
Main IL Instruction Count
199
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_14
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String ZapretGUI.Core::Root
ldarg.0 <null>
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_0051: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr --cleanup
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_004B: ldloc.s V_16
call System.Int32 ZapretGUI.CleanupMode::Run()
stloc.s V_13
leave IL_01C1: ldloc.s V_13
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_002C: ldloc.s V_15
ldarg.0 <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_0086: ldloc.s V_18
ldloc.s V_17
ldloc.s V_18
ldelem.ref <null>
stloc.1 <null>
ldloc.1 <null>
ldstr --tgproxy-selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0080: ldloc.s V_18
call System.Int32 ZapretGUI.Program::SelfTestMain()
stloc.s V_13
leave IL_01C1: ldloc.s V_13
ldloc.s V_18
ldc.i4.1 <null>
add <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ldlen <null>
conv.i4 <null>
blt.s IL_0061: ldloc.s V_17
ldc.i4.0 <null>
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldc.i4.0 <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_010A: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --tray
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00B1: ldarg.0
ldc.i4.1 <null>
stloc.2 <null>
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --after-update
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00C5: ldarg.0
ldc.i4.1 <null>
stloc.3 <null>
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --resume
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00DA: ldarg.0
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --wait-pid
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0104: ldloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_6
ldelem.ref <null>
ldloca.s V_5
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.s V_6
ldc.i4.1 <null>
add <null>
stloc.s V_6
ldloc.s V_6
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_009D: ldarg.0
ldloc.s V_5
ldc.i4.0 <null>
ble.s IL_013F: ldc.i4.1
ldloc.s V_5
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_7
ldloc.s V_7
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
pop <null>
leave.s IL_013A: leave.s IL_013F
ldloc.s V_7
brfalse.s IL_0139: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_013F: ldc.i4.1
pop <null>
leave.s IL_013F: ldc.i4.1
ldc.i4.1 <null>
ldstr ZapretGUI_SingleInstance_Mutex
ldloca.s V_8
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_9
ldc.i4.0 <null>
ldc.i4.0 <null>
ldstr ZapretGUI_ShowWindow_Event
newobj System.Void System.Threading.EventWaitHandle::.ctor(System.Boolean,System.Threading.EventResetMode,System.String)
stloc.s V_10
ldloc.s V_8
brtrue.s IL_016A: ldsfld System.String ZapretGUI.Core::Root
ldloc.s V_10
callvirt System.Boolean System.Threading.EventWaitHandle::Set()
pop <null>
ldc.i4.0 <null>
ret <null>
ldsfld System.String ZapretGUI.Core::Root
call System.Void ZapretGUI.Updater::CleanOld(System.String)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldloc.s V_10
ldloc.2 <null>
ldloc.3 <null>
ldloc.s V_4
newobj System.Void ZapretGUI.MainForm::.ctor(System.Threading.EventWaitHandle,System.Boolean,System.Boolean,System.Boolean)
stloc.s V_11
ldloc.s V_11
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
leave.s IL_01B8: ldloc.s V_9
stloc.s V_12
ldstr Критическая ошибка: 
ldloc.s V_12
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr Zapret GUI
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01B8: ldloc.s V_9
ldloc.s V_9
call System.Void System.GC::KeepAlive(System.Object)
ldc.i4.0 <null>
ret <null>
ldloc.s V_13
ret <null>
Module Name
ZapretGUI.exe
Full Name
ZapretGUI.exe
EntryPoint
System.Int32 ZapretGUI.Program::Main(System.String[])
Scope Name
ZapretGUI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZapretGUI
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1268
Main Method
System.Int32 ZapretGUI.Program::Main(System.String[])
Main IL Instruction Count
199
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_14
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String ZapretGUI.Core::Root
ldarg.0 <null>
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_0051: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr --cleanup
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_004B: ldloc.s V_16
call System.Int32 ZapretGUI.CleanupMode::Run()
stloc.s V_13
leave IL_01C1: ldloc.s V_13
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_002C: ldloc.s V_15
ldarg.0 <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_0086: ldloc.s V_18
ldloc.s V_17
ldloc.s V_18
ldelem.ref <null>
stloc.1 <null>
ldloc.1 <null>
ldstr --tgproxy-selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0080: ldloc.s V_18
call System.Int32 ZapretGUI.Program::SelfTestMain()
stloc.s V_13
leave IL_01C1: ldloc.s V_13
ldloc.s V_18
ldc.i4.1 <null>
add <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ldlen <null>
conv.i4 <null>
blt.s IL_0061: ldloc.s V_17
ldc.i4.0 <null>
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldc.i4.0 <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_010A: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --tray
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00B1: ldarg.0
ldc.i4.1 <null>
stloc.2 <null>
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --after-update
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00C5: ldarg.0
ldc.i4.1 <null>
stloc.3 <null>
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --resume
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00DA: ldarg.0
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldelem.ref <null>
ldstr --wait-pid
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0104: ldloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0104: ldloc.s V_6
ldarg.0 <null>
ldloc.s V_6
ldc.i4.1 <null>
add <null>
dup <null>
stloc.s V_6
ldelem.ref <null>
ldloca.s V_5
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
pop <null>
ldloc.s V_6
ldc.i4.1 <null>
add <null>
stloc.s V_6
ldloc.s V_6
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_009D: ldarg.0
ldloc.s V_5
ldc.i4.0 <null>
ble.s IL_013F: ldc.i4.1
ldloc.s V_5
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_7
ldloc.s V_7
ldc.i4 30000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
pop <null>
leave.s IL_013A: leave.s IL_013F
ldloc.s V_7
brfalse.s IL_0139: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_013F: ldc.i4.1
pop <null>
leave.s IL_013F: ldc.i4.1
ldc.i4.1 <null>
ldstr ZapretGUI_SingleInstance_Mutex
ldloca.s V_8
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_9
ldc.i4.0 <null>
ldc.i4.0 <null>
ldstr ZapretGUI_ShowWindow_Event
newobj System.Void System.Threading.EventWaitHandle::.ctor(System.Boolean,System.Threading.EventResetMode,System.String)
stloc.s V_10
ldloc.s V_8
brtrue.s IL_016A: ldsfld System.String ZapretGUI.Core::Root
ldloc.s V_10
callvirt System.Boolean System.Threading.EventWaitHandle::Set()
pop <null>
ldc.i4.0 <null>
ret <null>
ldsfld System.String ZapretGUI.Core::Root
call System.Void ZapretGUI.Updater::CleanOld(System.String)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldloc.s V_10
ldloc.2 <null>
ldloc.3 <null>
ldloc.s V_4
newobj System.Void ZapretGUI.MainForm::.ctor(System.Threading.EventWaitHandle,System.Boolean,System.Boolean,System.Boolean)
stloc.s V_11
ldloc.s V_11
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
leave.s IL_01B8: ldloc.s V_9
stloc.s V_12
ldstr Критическая ошибка: 
ldloc.s V_12
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr Zapret GUI
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_01B8: ldloc.s V_9
ldloc.s V_9
call System.Void System.GC::KeepAlive(System.Object)
ldc.i4.0 <null>
ret <null>
ldloc.s V_13
ret <null>

3 files
EXE3dbcbf0708a3abe17082416cfd1c0fcb
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙