Suspicious
Suspect

PE Executable
MD5: c75e1d1d05c652e3254554062591fa6f
Size: 805.89 KB
application/x-dosexec

This sample is a 787 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 23 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9cc2ff7618612a455e70616103849442a0fa1fc71fb0843f521fc99a24c51bd5
MD5
c75e1d1d05c652e3254554062591fa6f
Verdict
Inconclusive
File type
PE Executable · 787 KB

Cite this report: https://app.malva.re/sha256/9cc2ff7618612a455e70616103849442a0fa1fc71fb0843f521fc99a24c51bd5

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
805.89 KB · 805,888 B
First seen
2025-08-25 23:01 · one year ago
Last seen
2025-08-25 23:01 · one year ago
Last analysis
2025-08-25 23:01 · one year ago
Hashes
MD5 c75e1d1d05c652e3254554062591fa6f Sha1 a8002385466367e47319641a5293ae41c5978488 Sha256 9cc2ff7618612a455e70616103849442a0fa1fc71fb0843f521fc99a24c51bd5 Sha384 35926fe5ece87edf5d661aa836cc8eda01da500c60deffc2a337d961f42ca4d5c17691ceb6c01233dd3be94406b4b1ab Sha512 527c6b7fca6202c7c4491b4774d600f607c56f128a0b2bc3c87759a948e603e7db6b6f46759ddc62942a4033cda22fe0f44686eda5875d4f5e1fd78c16028278 SSDeep 12288:GS4JriISA9V3+xgjD9osF3BhlPQ3lM1yOMWJEQeXLTsRzQzJm5IlWTm8VtP7yEa:pISA9oa397Llkq4OjEQ43sMJmrm8VtE TLSH 0B050294638BCA13D86647B408D2E3B153799D9DB531C31B4FE9BDEB7C3EB1629002A1
Detection
Symbol obfuscation
Low

24 files
EXEc75e1d1d05c652e3254554062591fa6f
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINWordleForms.GameOver.resources
BINWordleForms.WordleForm.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINTrue
DATA[NBF]root.Data
BINstatusStrip1.TrayLocation
BINtoolStrip1.TrayLocation
BINWordleForms.Properties.Resources.resources
BINdiGU
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINhelp_FILL0_wght300_GRAD0_opsz48
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINrestart
BINrestart_alt_FILL0_wght400_GRAD0_opsz48
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png

Name Value
Info
PDB Path: ?
Module Name
xUDn.exe
Full Name
xUDn.exe
EntryPoint
System.Void WordleForms.Program::Main()
Scope Name
xUDn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
xUDn
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
152
Main Method
System.Void WordleForms.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void WordleForms.WordleForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

24 files
EXEc75e1d1d05c652e3254554062591fa6f
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙