Suspicious
Suspect

4767403688d692546776f0df2f48eba9

PE Executable
MD5: 4767403688d692546776f0df2f48eba9
Size: 1.17 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 12 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
768b88bc6ad07b97723c930a5e63ffdaeb00dc3f7c2b38d99b08eeccc1df32a3
MD5
4767403688d692546776f0df2f48eba9
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/768b88bc6ad07b97723c930a5e63ffdaeb00dc3f7c2b38d99b08eeccc1df32a3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.17 MB · 1,170,944 B
First seen
2026-09-04 20:31 · one month ago
Last seen
2026-09-04 20:31 · one month ago
Last analysis
2026-09-04 20:32 · one month ago
Hashes
MD5 4767403688d692546776f0df2f48eba9 Sha1 244fa92a5772679aeb2f76820cb16681426c8cba Sha256 768b88bc6ad07b97723c930a5e63ffdaeb00dc3f7c2b38d99b08eeccc1df32a3 Sha384 a3cb69147b43c28a7b67a23854195c00a0d79aaea398befbcb2583ce9cad118d479df68fe6075b8db78b01e1a0b97a4d Sha512 bf1af286be0295c4bca3289a493ab87d847ec18c02c21e0140e82e31efa241d860e10bee054a43aa838958fc3d437b0ed5f4757e8ebc8c17949650b3da06b269 SSDeep 24576:3WWeSH2c511fHnAG1Z9oSUnvUigB2fFeWRw4fbUUReeP95MEeRWOhg:mWHBHnTZ9oSUv24Hm+UPeXnGh TLSH E845E09C3215F89FC853CE718AA4EDB4A5206DA6930BC20395E72DEBB91D1C79E141F3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

13 files
EXE4767403688d692546776f0df2f48eba9
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINRegenGarten.Properties.Resources.resources
BINISzr
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINTK
DATA[NBF]root.Data
BINRegenGarten.TempestasForm.resources
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Module Name
tRnI.exe
Full Name
tRnI.exe
EntryPoint
System.Void RegenGarten.Program::Main()
Scope Name
tRnI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tRnI
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void RegenGarten.Program::Main()
Main IL Instruction Count
25
Main IL 
nop <null>
call System.Void RegenGarten.Program::‌‭‎‏​‭‍‏‎​‮‎‫‪‎‌‬‪‌‌‏‮‎‍‏‌‮()
nop <null>
ldc.i4.0 <null>
call System.Void RegenGarten.Program::‭​‏‮‏‌‌‎‬‫‍‭‮‍‮‫‌‫‌​‪‏‍‎‪​‍‮‫‫‌‮(System.Boolean)
nop <null>
newobj System.Void RegenGarten.HortusForm::.ctor()
call System.Void RegenGarten.Program::‬‌‪‭‎‌‍‫‎​‍‭​‬​‫‬‫‪‎‭‏​‫‬‮(System.Windows.Forms.Form)
ldc.i4 -1849429535
ldc.i4 -1486857705
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_004A: ret
nop <null>
ldloc.0 <null>
ldc.i4 -1424294291
mul <null>
ldc.i4 -1528070125
xor <null>
br.s IL_001D: ldc.i4 -1486857705
ret <null>
Module Name
tRnI.exe
Full Name
tRnI.exe
EntryPoint
System.Void RegenGarten.Program::Main()
Scope Name
tRnI.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tRnI
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void RegenGarten.Program::Main()
Main IL Instruction Count
25
Main IL 
nop <null>
call System.Void RegenGarten.Program::‌‭‎‏​‭‍‏‎​‮‎‫‪‎‌‬‪‌‌‏‮‎‍‏‌‮()
nop <null>
ldc.i4.0 <null>
call System.Void RegenGarten.Program::‭​‏‮‏‌‌‎‬‫‍‭‮‍‮‫‌‫‌​‪‏‍‎‪​‍‮‫‫‌‮(System.Boolean)
nop <null>
newobj System.Void RegenGarten.HortusForm::.ctor()
call System.Void RegenGarten.Program::‬‌‪‭‎‌‍‫‎​‍‭​‬​‫‬‫‪‎‭‏​‫‬‮(System.Windows.Forms.Form)
ldc.i4 -1849429535
ldc.i4 -1486857705
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.3 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_004A: ret
nop <null>
ldloc.0 <null>
ldc.i4 -1424294291
mul <null>
ldc.i4 -1528070125
xor <null>
br.s IL_001D: ldc.i4 -1486857705
ret <null>

13 files
EXE4767403688d692546776f0df2f48eba9
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙