4662103e4344ae19b8037d324e46539c

PE Executable

MD5: 4662103e4344ae19b8037d324e46539c

Size: 1.06 MB

application/x-dosexec

This sample is a 1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: cf22f9ec1c9f574b8281ee9c4bdb301be36ad83bbe6fa01c60b99b4e28a4acec
MD5: 4662103e4344ae19b8037d324e46539c
Verdict: Inconclusive
File type: PE Executable · 1 MB

Cite this report: https://app.malva.re/sha256/cf22f9ec1c9f574b8281ee9c4bdb301be36ad83bbe6fa01c60b99b4e28a4acec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.06 MB · 1,061,888 B

Hashes

MD5 4662103e4344ae19b8037d324e46539c Sha1 9a7d1b1b4917769e55101f4d3daf08272ec90f2f Sha256 cf22f9ec1c9f574b8281ee9c4bdb301be36ad83bbe6fa01c60b99b4e28a4acec Sha384 8be159b1224d4e6a3776de1e6426ab9fc4c40581d2f070cd7d868feb198387700a243ebe1f17344869f48e668b9e9497 Sha512 dbbd106c000f23618fe02432a15f0c371172347f60802ef923d3bc6c8de97522699a4e0824c5de4f0f0ff7da0f5ec381f1e0c2c31a0a3534c2ebb31c233f6604 SSDeep 24576:dOS9gE6iSm0IfrdKVq6eaGxfAVmNGBFNCt3yyyA:HCmRrcq6eay4Vm8BFN4yA TLSH BC35BFE83300E49EC453CA758835DDB3A5226D6E8E1AC20B64E77E5F7D2E38749121E7

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

16 files

EXE4662103e4344ae19b8037d324e46539c

Structure

BIN.Net Resources

BINRegenGarten.TempestasForm.resources

BINRegenGarten.Properties.Resources.resources

BINTK

DATA[NBF]root.Data

BINwcfN

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINResources

BINRT_ICON

BINID:0001

BINID:0

BINID:0002

BINID:0

BINID:0003

BINID:0

BINID:0004

BINID:0

BINID:0005

BINID:0

BINRT_GROUP_CURSOR4

BINID:0001

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name	Value
Module Name	JBtN.exe
Full Name	JBtN.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	JBtN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JBtN
Assembly Version	201.502.607.709
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	37
Main IL	nop <null> call System.Void RegenGarten.Program::‌⁫‏‎‏‬⁮‎‏⁬⁮‪⁭⁭⁭‍‮⁬‏⁪‪‎⁬⁬‬‌⁮⁮‪‍‮⁫‎⁬⁯‎‮() ldc.i4 -1040443850 ldc.i4 -146611235 xor <null> dup <null> stloc.0 <null> ldc.i4.5 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0070: ret newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::‌‫‏‫⁬‮‭‮‪⁮⁫⁬⁫⁬‭‌⁯‫‬‬⁪‍⁭‏‭⁮‫⁫‎‮⁭‮⁪‏⁪‫‬‪‫‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 -1270055638 mul <null> ldc.i4 -1864904826 xor <null> br.s IL_000B: ldc.i4 -146611235 ldc.i4.0 <null> call System.Void RegenGarten.Program::‌‏‌⁯‮⁯‮‭‎⁬⁬‌⁬‮⁮‎‪⁫‏‍‌⁮⁭‪‍⁬⁬⁯‮‮⁪⁪‎‮‪‮‎‬‮‎‮(System.Boolean) nop <null> ldloc.0 <null> ldc.i4 988406087 mul <null> ldc.i4 384078402 xor <null> br.s IL_000B: ldc.i4 -146611235 nop <null> ldloc.0 <null> ldc.i4 -365241169 mul <null> ldc.i4 -1112970096 xor <null> br.s IL_000B: ldc.i4 -146611235 ret <null>
Module Name	JBtN.exe
Full Name	JBtN.exe
EntryPoint	System.Void RegenGarten.Program::Main()
Scope Name	JBtN.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	JBtN
Assembly Version	201.502.607.709
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	0
Main Method	System.Void RegenGarten.Program::Main()
Main IL Instruction Count	37
Main IL	nop <null> call System.Void RegenGarten.Program::‌⁫‏‎‏‬⁮‎‏⁬⁮‪⁭⁭⁭‍‮⁬‏⁪‪‎⁬⁬‬‌⁮⁮‪‍‮⁫‎⁬⁯‎‮() ldc.i4 -1040443850 ldc.i4 -146611235 xor <null> dup <null> stloc.0 <null> ldc.i4.5 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0070: ret newobj System.Void RegenGarten.HortusForm::.ctor() call System.Void RegenGarten.Program::‌‫‏‫⁬‮‭‮‪⁮⁫⁬⁫⁬‭‌⁯‫‬‬⁪‍⁭‏‭⁮‫⁫‎‮⁭‮⁪‏⁪‫‬‪‫‮(System.Windows.Forms.Form) nop <null> ldloc.0 <null> ldc.i4 -1270055638 mul <null> ldc.i4 -1864904826 xor <null> br.s IL_000B: ldc.i4 -146611235 ldc.i4.0 <null> call System.Void RegenGarten.Program::‌‏‌⁯‮⁯‮‭‎⁬⁬‌⁬‮⁮‎‪⁫‏‍‌⁮⁭‪‍⁬⁬⁯‮‮⁪⁪‎‮‪‮‎‬‮‎‮(System.Boolean) nop <null> ldloc.0 <null> ldc.i4 988406087 mul <null> ldc.i4 384078402 xor <null> br.s IL_000B: ldc.i4 -146611235 nop <null> ldloc.0 <null> ldc.i4 -365241169 mul <null> ldc.i4 -1112970096 xor <null> br.s IL_000B: ldc.i4 -146611235 ret <null>

16 files

EXE4662103e4344ae19b8037d324e46539c

Structure

BIN.Net Resources

BINResources

No malware configuration was found at this point.

4662103e4344ae19b8037d324e46539c

Overview

Summary by MalvaGPT

Characteristics

File Structure

Information38

4662103e4344ae19b8037d324e46539c (1.06 MB)

File Structure