Suspicious
Suspect

59f94c914a02913c034de99447c86b52

Share on LinkedIn
Print
PE Executable
MD5: 59f94c914a02913c034de99447c86b52
Size: 1.63 MB
application/x-dosexec

This sample is a 1.6 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9
MD5
59f94c914a02913c034de99447c86b52
Verdict
Inconclusive
File type
PE Executable · 1.6 MB

Cite this report: https://app.malva.re/sha256/fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.63 MB · 1,630,208 B
First seen
2026-09-10 11:15 · one month ago
Last seen
2026-09-10 11:15 · one month ago
Last analysis
2026-09-10 11:16 · one month ago
Hashes
MD5 59f94c914a02913c034de99447c86b52 Sha1 9cee61773e655e93cd4d0082f5007fa6b2e8f63e Sha256 fa8b746a80361406905c76ea9dac1ccc3921049705faa6f396c184decc2d51b9 Sha384 4b1e5d29739bec591b30dc32fa8bc02fa3fbc30a2b1be9dff848e82a1444d53f8da1d78ab2da68e36bbdfeaf0013b836 Sha512 3ae6989b056cdb6d3e77c688e39b9c14d4e58f53faec17d85c4f7b4ed61f31774d4aad19bb06f063cebff6538bb87345721338a3d28886b92ae2f740316d2a8d SSDeep 49152:6b/2oSV+dICgRRHoCS3D9ipGaR5CiuUtOtZzMG:6buoKCgPBg5ipGaXC7Zz TLSH E575125822A5EE02D2E26BF41C20F3B857B91E497922E3078EF5ADDFB5396443D452C3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

9 files
EXE59f94c914a02913c034de99447c86b52
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
xfts.exe
Full Name
xfts.exe
EntryPoint
System.Void CharcoalKiln.Program::Main()
Scope Name
xfts.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xfts
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
429
Main Method
System.Void CharcoalKiln.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CharcoalKiln.UgnForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
xfts.exe
Full Name
xfts.exe
EntryPoint
System.Void CharcoalKiln.Program::Main()
Scope Name
xfts.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xfts
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
429
Main Method
System.Void CharcoalKiln.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CharcoalKiln.UgnForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙