Suspicious
Suspect

4ce07cb988ff1d08e90b93163b570a64

PE Executable
MD5: 4ce07cb988ff1d08e90b93163b570a64
Size: 131.09 KB
application/x-dosexec

This sample is a 128 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 47 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c4a2ef7868512cc9a7d77b42cf602cd75fef0d4dcbf8a3ba7fe1334b3ac1b5c4
MD5
4ce07cb988ff1d08e90b93163b570a64
Verdict
Inconclusive
File type
PE Executable · 128 KB

Cite this report: https://app.malva.re/sha256/c4a2ef7868512cc9a7d77b42cf602cd75fef0d4dcbf8a3ba7fe1334b3ac1b5c4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
131.09 KB · 131,088 B
First seen
2026-10-14 16:30 · 12 days ago
Last seen
2026-10-14 16:30 · 12 days ago
Last analysis
2026-10-14 16:36 · 12 days ago
Hashes
MD5 4ce07cb988ff1d08e90b93163b570a64 Sha1 efab9ace9e647d845f32b46cfa872fce42bf11be Sha256 c4a2ef7868512cc9a7d77b42cf602cd75fef0d4dcbf8a3ba7fe1334b3ac1b5c4 Sha384 cd910d8fabeb54e1fa70f1c4600f5ee95c86809dbc3eb4b88ea715bef2190fc41a7937197c9b57c401285d08a4734351 Sha512 7c4d4e1857ce7f89ed032230223f09998ccfd4386c93aa5816b65ffcadd84336b5ff00afe9d693eeda17b52a84536c827372d9c041d12467255d161ae718ab9e SSDeep 3072:jMKbLskd4qpPSU4+eVhQiwbOENVMW87hm3qe:jMKbwkeYPN4+cgW7hc TLSH 91D3F8933A184C1FC15E1275FCAB989E4779AD436902D3CB0A85F9AE5EF27053F02297
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

48 files
EXE4ce07cb988ff1d08e90b93163b570a64
Structure
P7B[Authenticode]_18566b72.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINScreenCaptureTool.g.resources
BINScreenCaptureTool.FrmCapture.resources
BINScreenCaptureTool.Properties.Resources.resources
BIN_out
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINarrow
BINbold
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINbrush
BINcancel
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINclose
BINcolor
DATA[NBF]root.Data
BINellips
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlarge
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINlongcut
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINmiddle
BINmosaic
BINnone
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINok
BINpeg
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINrect
BINsave
BINseparator
BINsmall
BINtext
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
ScreenCaptureTool.exe
Full Name
ScreenCaptureTool.exe
EntryPoint
System.Void ScreenCaptureTool.Program::Main(System.String[])
Scope Name
ScreenCaptureTool.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ScreenCaptureTool
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
189
Info
Authenticode present at 0x1E800 size 6160 bytes
Info 
PDB Path: D:\jenkins\workspace\hsz-taxbrowser_?????????\Apps\ScreenCapture\obj\Release\ScreenCaptureTool.pdb
Main Method
System.Void ScreenCaptureTool.Program::Main(System.String[])
Main IL Instruction Count
136
Main IL 
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ScreenCaptureTool.Program::Application_ThreadException(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ScreenCaptureTool.Program::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
newobj System.Void ScreenCaptureTool.CallParms::.ctor()
stloc.0 <null>
ldarg.0 <null>
brfalse.s IL_0049: ldc.i4.0
ldarg.0 <null>
ldlen <null>
brfalse.s IL_0049: ldc.i4.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr KungeekCall20230206
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0054: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_015B: ret
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_0122: leave.s IL_0127
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String System.Web.HttpUtility::UrlDecode(System.String)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 38
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_0119: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 61
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.0 <null>
callvirt System.Type System.Object::GetType()
ldloc.3 <null>
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
stloc.s V_4
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
callvirt System.Type System.Type::get_BaseType()
ldtoken System.Enum
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_00D9: ldloc.s V_4
ldloc.s V_4
ldloc.0 <null>
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Enum::Parse(System.Type,System.String)
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
br.s IL_0115: ldloc.2
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
ldtoken System.Boolean
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_0109: ldloc.s V_4
ldloc.s V_4
ldloc.0 <null>
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Boolean System.Boolean::Parse(System.String)
box System.Boolean
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
br.s IL_0115: ldloc.2
ldloc.s V_4
ldloc.0 <null>
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt IL_007E: ldloc.1
leave.s IL_0127: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
pop <null>
leave.s IL_0127: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldloc.0 <null>
newobj System.Void ScreenCaptureTool.FrmCapture::.ctor(ScreenCaptureTool.CallParms)
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_015B: ret
stloc.s V_5
ldstr 主线程异常
ldloc.s V_5
call System.Void ScreenCaptureTool.LogManager::Error(System.String,System.Exception)
ldc.i4.m1 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_015B: ret
ret <null>
Module Name
ScreenCaptureTool.exe
Full Name
ScreenCaptureTool.exe
EntryPoint
System.Void ScreenCaptureTool.Program::Main(System.String[])
Scope Name
ScreenCaptureTool.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ScreenCaptureTool
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
189
Main Method
System.Void ScreenCaptureTool.Program::Main(System.String[])
Main IL Instruction Count
136
Main IL 
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ScreenCaptureTool.Program::Application_ThreadException(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ScreenCaptureTool.Program::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
newobj System.Void ScreenCaptureTool.CallParms::.ctor()
stloc.0 <null>
ldarg.0 <null>
brfalse.s IL_0049: ldc.i4.0
ldarg.0 <null>
ldlen <null>
brfalse.s IL_0049: ldc.i4.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr KungeekCall20230206
call System.Boolean System.String::op_Inequality(System.String,System.String)
brfalse.s IL_0054: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_015B: ret
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_0122: leave.s IL_0127
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String System.Web.HttpUtility::UrlDecode(System.String)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 38
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_0119: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 61
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.0 <null>
callvirt System.Type System.Object::GetType()
ldloc.3 <null>
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
stloc.s V_4
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
callvirt System.Type System.Type::get_BaseType()
ldtoken System.Enum
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_00D9: ldloc.s V_4
ldloc.s V_4
ldloc.0 <null>
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Enum::Parse(System.Type,System.String)
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
br.s IL_0115: ldloc.2
ldloc.s V_4
callvirt System.Type System.Reflection.PropertyInfo::get_PropertyType()
ldtoken System.Boolean
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_0109: ldloc.s V_4
ldloc.s V_4
ldloc.0 <null>
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Boolean System.Boolean::Parse(System.String)
box System.Boolean
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
br.s IL_0115: ldloc.2
ldloc.s V_4
ldloc.0 <null>
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldnull <null>
callvirt System.Void System.Reflection.PropertyInfo::SetValue(System.Object,System.Object,System.Object[])
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt IL_007E: ldloc.1
leave.s IL_0127: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
pop <null>
leave.s IL_0127: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldloc.0 <null>
newobj System.Void ScreenCaptureTool.FrmCapture::.ctor(ScreenCaptureTool.CallParms)
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_015B: ret
stloc.s V_5
ldstr 主线程异常
ldloc.s V_5
call System.Void ScreenCaptureTool.LogManager::Error(System.String,System.Exception)
ldc.i4.m1 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_015B: ret
ret <null>

48 files
EXE4ce07cb988ff1d08e90b93163b570a64
Structure
P7B[Authenticode]_18566b72.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙