Suspicious
Suspect

89ed5fcaffa2f2bb6db3c8206da67d31

Share on LinkedIn
Print
PE Executable
MD5: 89ed5fcaffa2f2bb6db3c8206da67d31
Size: 812.03 KB
application/x-dosexec

This sample is a 793 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 37 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bbe069fd820088df5b2cf3f6eafef9af26d373dc2d41cdb1aa4a4f31295f422f
MD5
89ed5fcaffa2f2bb6db3c8206da67d31
Verdict
Inconclusive
File type
PE Executable · 793 KB

Cite this report: https://app.malva.re/sha256/bbe069fd820088df5b2cf3f6eafef9af26d373dc2d41cdb1aa4a4f31295f422f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
812.03 KB · 812,032 B
First seen
2025-11-24 14:46 · 11 months ago
Last seen
2025-11-24 14:46 · 11 months ago
Last analysis
2025-11-24 14:52 · 11 months ago
Hashes
MD5 89ed5fcaffa2f2bb6db3c8206da67d31 Sha1 6fcd016091e8e48c036371b1974c1a03a2555140 Sha256 bbe069fd820088df5b2cf3f6eafef9af26d373dc2d41cdb1aa4a4f31295f422f Sha384 f6b75f8fb10b1b220201b774d839c8251ba7d584e966dcde98c764dd7fd66866ae6fca142bd90110b8abb3b849182508 Sha512 7745f675f836e0e2744257d379222809323f18cd00f02854414ebb1c0c2238b78e2ce249b6380ce5272ab61efd1473d947b970ca9e63e61569fa6b5f85ca9537 SSDeep 24576:mbyPgd5SPYSEqsQuK7IHgfYUyWVCYroGkETgQb:mWm5SPYusQu/HXUXVCYroGDb TLSH 92050156362AEE03C8664AF01651C2F157B46DDEA125D2C7AEDB3DDBF4EAF1021003A7
Detection
Symbol obfuscation
Low

38 files
EXE89ed5fcaffa2f2bb6db3c8206da67d31
Structure

Name Value
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\wrtvaAgxdD\src\obj\Debug\lIQRD.pdb
Module Name
lIQRD.exe
Full Name
lIQRD.exe
EntryPoint
System.Void Calculator.Program::Main()
Scope Name
lIQRD.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
lIQRD
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
401
Main Method
System.Void Calculator.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Calculator.frmain::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙