Suspicious
Suspect

9fafa8477afb6501c7ad2136426c6333

PE Executable
MD5: 9fafa8477afb6501c7ad2136426c6333
Size: 207.87 KB
application/x-dosexec

This sample is a 203 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fe711164fb5e08334e72ae447407a3e20a9355f8a862a233a4251be8637400f3
MD5
9fafa8477afb6501c7ad2136426c6333
Verdict
Inconclusive
File type
PE Executable · 203 KB

Cite this report: https://app.malva.re/sha256/fe711164fb5e08334e72ae447407a3e20a9355f8a862a233a4251be8637400f3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
207.87 KB · 207,872 B
First seen
2026-06-30 08:15 · 4 months ago
Last seen
2026-06-30 08:15 · 4 months ago
Last analysis
2026-07-02 00:59 · 3 months ago
Hashes
MD5 9fafa8477afb6501c7ad2136426c6333 Sha1 2f12cd19684254160d5c063d54420ca8b44ee813 Sha256 fe711164fb5e08334e72ae447407a3e20a9355f8a862a233a4251be8637400f3 Sha384 4b898502a24343336742801745d22eeaf1cf1f1a3cae26b252146f43a9e4fb879f1f140d25a3ef563817c1bed14c3c6a Sha512 f905dd278e784651fbbb179165e3244a03023e3e982f17f6eb995e0d7adb6e76c710c47ca7b06a67ab93c235bf8f9097da8e90571817dd81989c3f586cdfc88f SSDeep 3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIOPSnfr0CEE9R4szJbGxBzU9ys:MLV6Bta6dtJmakIM5Knz0mJ+zAapxju TLSH 1F14CF167BA8492FE2DE85BDA01256128379C2E3EDD3F3DE28D455B79B227E006071D3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

4 files
EXE9fafa8477afb6501c7ad2136426c6333
Structure
BINResources
BINRT_RCDATA
BINID:0001
BINID:0
BIN.Net Resources
BINClientLoaderForm.resources
BIN          

Name Value
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

4 files
EXE9fafa8477afb6501c7ad2136426c6333
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙