Suspect
PE Executable
MD5: 7fca5d3b8a0e93d832286ef1a69b916b
Size: 777.73 KB
application/x-dosexec
This sample is a 759.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 20 embedded or derived files. It matches 7 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7c0ae21238ad30ce174f1b9d432cc1205546304825c4bf39dfd665b2e47cd0e9
- MD5
- 7fca5d3b8a0e93d832286ef1a69b916b
- Verdict
- Inconclusive
- File type
- PE Executable · 759.5 KB
Cite this report: https://app.malva.re/sha256/7c0ae21238ad30ce174f1b9d432cc1205546304825c4bf39dfd665b2e47cd0e9
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
777.73 KB · 777,729 B
First seen
2026-10-05 16:15 · 21 days ago
Last seen
2026-10-05 16:15 · 21 days ago
Last analysis
2026-10-05 16:15 · 21 days ago
Hashes
MD5
7fca5d3b8a0e93d832286ef1a69b916b
Sha1
e07b1032053d0b7c494cb5891c048e18690f21ce
Sha256
7c0ae21238ad30ce174f1b9d432cc1205546304825c4bf39dfd665b2e47cd0e9
Sha384
dbc6e302a38b5e99acfb6fca5c8779b442f264d2787ae96675aaa42d8c2d981912a15270aec58649d2cd2a1a78f58481
Sha512
34b475ce45ef179f2472d469b8701056356e71f033f5052b33e556aab3205440fdf438f4be8e8eb89c9f402a064591cb67688bbdda8f7260e1619b2e2b02d2f9
SSDeep
12288:LtiZKsHedREOpuXCbSAjW4uCmlqoOt1Zf9oewEGX22uOT/ocOdF7vo7xy4b/A:LtdsHedm24uJbzaP7BoS9yK4
TLSH
44F4C02425A35E31D26D4AF7E4EC8840137AD6BC9FAFFF29504F46BCAD03356A213952
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
21 files
EXE7fca5d3b8a0e93d832286ef1a69b916b
Structure
BINOverlay_83878c91.bin
BINResources
BIN.Net Resources
STICH
beta
No STICH Path has been generated for this analysis yet.
2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
2| Name | Value |
|---|---|
| Info | Overlay extracted: Overlay_83878c91.bin (1 bytes) |
| Module Name | Noogen.Validation.dll |
| Full Name | Noogen.Validation.dll |
| Scope Name | Noogen.Validation.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Noogen.Validation |
| Assembly Version | 12.7.5.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 45 |
| Main Method | Not found or no body |
| Module Name | Noogen.Validation.dll |
| Full Name | Noogen.Validation.dll |
| Scope Name | Noogen.Validation.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Noogen.Validation |
| Assembly Version | 12.7.5.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 45 |
| Main Method | Not found or no body |