Suspicious
Suspect

bf0540b7533ad3a6b25f31c9b437bc71

PE Executable
MD5: bf0540b7533ad3a6b25f31c9b437bc71
Size: 7.17 KB
application/x-dosexec

This sample is a 7 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
95a224496f714732232d95ad8d217a6dc4563ba5a686a4617e3d64f5a01dba39
MD5
bf0540b7533ad3a6b25f31c9b437bc71
Verdict
Inconclusive
File type
PE Executable · 7 KB

Cite this report: https://app.malva.re/sha256/95a224496f714732232d95ad8d217a6dc4563ba5a686a4617e3d64f5a01dba39

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
7.17 KB · 7,168 B
First seen
2026-10-21 11:46 · 7 days ago
Last seen
2026-10-21 11:46 · 7 days ago
Last analysis
2026-10-21 11:46 · 7 days ago
Hashes
MD5 bf0540b7533ad3a6b25f31c9b437bc71 Sha1 cc52031547bc676911b27bfdf3f843922ebf0948 Sha256 95a224496f714732232d95ad8d217a6dc4563ba5a686a4617e3d64f5a01dba39 Sha384 19c54ff77f4942d98bd86721c694dbfa41b72d8e301d350c9c379853e1f6a89719380b91b6c5b8fe6a1b52fefb39cb56 Sha512 65134ce74c5eff8b34f65dfff21cad67e19ed05aa03133ca347f00347115f2e7e9650357ab8593cfed343fa627e85c4af37a3604c2ce879b135b6341da8009e9 SSDeep 96:dU/Obuz1I0z9MOyosj4kzp0mu6WNb53K0L3u4Vt80eWQ2zNt:dUGbO9z9Qgmu6WNlNzVy0wQ TLSH 04E1C44AE3EC8E2DE0EE077D5DB347105B75A6925EA3834E18C81549EE623851B427F1
Detection
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Low

3 files
EXEbf0540b7533ad3a6b25f31c9b437bc71
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
uia_dialog.exe
Full Name
uia_dialog.exe
EntryPoint
System.Void P::Main(System.String[])
Scope Name
uia_dialog.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uia_dialog
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
26
Main Method
System.Void P::Main(System.String[])
Main IL Instruction Count
83
Main IL 
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0021: ldarg.0
nop <null>
ldstr usage: desk fx fy
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_00BC: ret
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4 321
call System.IntPtr P::OpenDesktop(System.String,System.UInt32,System.Boolean,System.UInt32)
stloc.0 <null>
ldloc.0 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Equality(System.IntPtr,System.IntPtr)
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0062: ldloc.0
nop <null>
ldstr OPEN_FAIL 
call System.Int32 System.Runtime.InteropServices.Marshal::GetLastWin32Error()
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br.s IL_00BC: ret
ldloc.0 <null>
call System.Boolean P::SetThreadDesktop(System.IntPtr)
pop <null>
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.2 <null>
nop <null>
ldloc.1 <null>
conv.r8 <null>
ldloc.2 <null>
conv.r8 <null>
newobj System.Void System.Windows.Point::.ctor(System.Double,System.Double)
call System.Windows.Automation.AutomationElement System.Windows.Automation.AutomationElement::FromPoint(System.Windows.Point)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void P::Do(System.Windows.Automation.AutomationElement,System.Int32,System.Int32)
nop <null>
nop <null>
leave.s IL_00B4: nop
stloc.s V_4
nop <null>
ldstr ERR 
ldloc.s V_4
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_00B4: nop
nop <null>
ldloc.0 <null>
call System.Boolean P::CloseDesktop(System.IntPtr)
pop <null>
ret <null>
Module Name
uia_dialog.exe
Full Name
uia_dialog.exe
EntryPoint
System.Void P::Main(System.String[])
Scope Name
uia_dialog.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uia_dialog
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
26
Main Method
System.Void P::Main(System.String[])
Main IL Instruction Count
83
Main IL 
nop <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.3 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0021: ldarg.0
nop <null>
ldstr usage: desk fx fy
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_00BC: ret
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4 321
call System.IntPtr P::OpenDesktop(System.String,System.UInt32,System.Boolean,System.UInt32)
stloc.0 <null>
ldloc.0 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Equality(System.IntPtr,System.IntPtr)
ldc.i4.0 <null>
ceq <null>
stloc.s V_5
ldloc.s V_5
brtrue.s IL_0062: ldloc.0
nop <null>
ldstr OPEN_FAIL 
call System.Int32 System.Runtime.InteropServices.Marshal::GetLastWin32Error()
box System.Int32
call System.String System.String::Concat(System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br.s IL_00BC: ret
ldloc.0 <null>
call System.Boolean P::SetThreadDesktop(System.IntPtr)
pop <null>
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.1 <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
stloc.2 <null>
nop <null>
ldloc.1 <null>
conv.r8 <null>
ldloc.2 <null>
conv.r8 <null>
newobj System.Void System.Windows.Point::.ctor(System.Double,System.Double)
call System.Windows.Automation.AutomationElement System.Windows.Automation.AutomationElement::FromPoint(System.Windows.Point)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
ldloc.2 <null>
call System.Void P::Do(System.Windows.Automation.AutomationElement,System.Int32,System.Int32)
nop <null>
nop <null>
leave.s IL_00B4: nop
stloc.s V_4
nop <null>
ldstr ERR 
ldloc.s V_4
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_00B4: nop
nop <null>
ldloc.0 <null>
call System.Boolean P::CloseDesktop(System.IntPtr)
pop <null>
ret <null>

3 files
EXEbf0540b7533ad3a6b25f31c9b437bc71
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙