Suspicious
Suspect

7064c4ab884abd3d867dc8ba65cda26b

Share on LinkedIn
Print
PE Executable
MD5: 7064c4ab884abd3d867dc8ba65cda26b
Size: 594.43 KB
application/x-dosexec

This sample is a 580.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 17 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
42042cbfb880a7312bf79970fa34f28d5efc05e78c59413dacf356c3f5f1334b
MD5
7064c4ab884abd3d867dc8ba65cda26b
Verdict
Inconclusive
File type
PE Executable · 580.5 KB

Cite this report: https://app.malva.re/sha256/42042cbfb880a7312bf79970fa34f28d5efc05e78c59413dacf356c3f5f1334b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
594.43 KB · 594,432 B
First seen
2026-10-25 17:30 · 2 days ago
Last seen
2026-10-25 17:30 · 2 days ago
Last analysis
2026-10-25 17:30 · 2 days ago
Hashes
MD5 7064c4ab884abd3d867dc8ba65cda26b Sha1 2a3341f2f4c468f55651ba9a8a49d716c599631f Sha256 42042cbfb880a7312bf79970fa34f28d5efc05e78c59413dacf356c3f5f1334b Sha384 e661af0b38c3b761486f9570f48e83359340c03484ba862cc4cc6c3039274678bfc41a18c90294569081f87f29a4ddb0 Sha512 53259d779c5e168e34c62312cf3ed8f177333e62d6abaf74a952359944ae6beface99da3f8aac133f2ef326964eb07c6cdb31170fb2622372f61c26b1d0c4e86 SSDeep 12288:dkqAOff8KtUFjCrqwXu6LpSXiRQtC3uogq58yJg5ua:xfr6Cr3u6LpSXiRQtC3uog88qG TLSH 42C4F174636AEB02D8B513F40970F23867B65D8EB531D3068EE6ADDF7D15F042A08A93
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

18 files
EXE7064c4ab884abd3d867dc8ba65cda26b
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
dDnb.exe
Full Name
dDnb.exe
EntryPoint
System.Void NuclearControl.Program::Main()
Scope Name
dDnb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dDnb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
296
Main Method
System.Void NuclearControl.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NuclearControl.PlantForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
dDnb.exe
Full Name
dDnb.exe
EntryPoint
System.Void NuclearControl.Program::Main()
Scope Name
dDnb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
dDnb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
296
Main Method
System.Void NuclearControl.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NuclearControl.PlantForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙