Suspicious
Suspect

7b323d1fbe7b6b5d910d432fbe861a8e

Share on LinkedIn
Print
PE Executable
MD5: 7b323d1fbe7b6b5d910d432fbe861a8e
Size: 900.1 KB
application/x-dosexec

This sample is a 879 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
8e264d38bdfddb1cba5595e88d32d4e1dc133c9babd91132dcbda4c50b94a56c
MD5
7b323d1fbe7b6b5d910d432fbe861a8e
Verdict
Inconclusive
File type
PE Executable · 879 KB

Cite this report: https://app.malva.re/sha256/8e264d38bdfddb1cba5595e88d32d4e1dc133c9babd91132dcbda4c50b94a56c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
900.1 KB · 900,096 B
First seen
2026-10-19 08:01 · 14 days ago
Last seen
2026-10-19 08:01 · 14 days ago
Last analysis
2026-10-19 08:02 · 14 days ago
Hashes
MD5 7b323d1fbe7b6b5d910d432fbe861a8e Sha1 87a2d73d4622643a3bf29eb4a1e8962a9c445845 Sha256 8e264d38bdfddb1cba5595e88d32d4e1dc133c9babd91132dcbda4c50b94a56c Sha384 56ff967a998fbc1fce9270ce7bb3db241849dce3b98f5f20040701f70671c48dc7bde4f7ccb13e64fb0fbeb77a5bcf45 Sha512 29ddc79b17f8242bd956982d4ce26cbd6f7dcea6057ef7b73cc398371d0315474e482609a13606ef906f3fdec310d755b67a3e78397ce65a7aa4af29032d6690 SSDeep 24576:U7FcCcyM8fdDHzgrkj4vGS1gYkm3R4C4NAupl:UcCDdrzN4vG384C0fpl TLSH 0415CF28156B8512E9F26FF01EB0A1F06B657CA6B139E4291FC20DABF5777047E4132B
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

9 files
EXE7b323d1fbe7b6b5d910d432fbe861a8e
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
RcLR.exe
Full Name
RcLR.exe
EntryPoint
System.Void VineyardFrost.Program::Main()
Scope Name
RcLR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RcLR
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
405
Main Method
System.Void VineyardFrost.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void VineyardFrost.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
RcLR.exe
Full Name
RcLR.exe
EntryPoint
System.Void VineyardFrost.Program::Main()
Scope Name
RcLR.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RcLR
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
405
Main Method
System.Void VineyardFrost.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void VineyardFrost.MainForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙