Suspicious
Suspect

cbb907d008c300b1ba66d760d71263a8

Share on LinkedIn
Print
PE Executable
MD5: cbb907d008c300b1ba66d760d71263a8
Size: 12.07 MB
application/x-dosexec

This sample is a 11.5 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 10 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
MD5
cbb907d008c300b1ba66d760d71263a8
Verdict
Inconclusive
File type
PE Executable · 11.5 MB

Cite this report: https://app.malva.re/sha256/329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
12.07 MB · 12,068,352 B
First seen
2026-08-04 20:01 · 2 months ago
Last seen
2026-08-04 20:01 · 2 months ago
Last analysis
2026-08-04 20:01 · 2 months ago
Hashes
MD5 cbb907d008c300b1ba66d760d71263a8 Sha1 fc957170cafa2c8b35acefd858ec2530b52a407f Sha256 329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8 Sha384 c9f60eb962218919c48e220d4e7edbe0a66ee637cc4538a46beab6d609847b2683aa027267fda93a1002246cc7dfa0cc Sha512 83af53a34337d73a3081b582c6153c773a43e7aa28bb748ebb1731c8a9da6b7fbe48475a5e884bc90534c33f49de33867e9a531b9159a7ea1a8fabfad3eb9fff SSDeep 196608:KyNHSFPZDFrMFipIjAPbRNrFO647KW2xXyvNbHkp+FQpDfynl8jxkOWlpRmYagg:Kky7FrM4/dS37kXSNbEDpDNxEP4Yagg TLSH F0C6332DDEE8D901CAE82B739263D178D170DE81EA1F8964C1F77E833D1D13625607AA
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
Symbol obfuscation
Low

11 files
EXEcbb907d008c300b1ba66d760d71263a8
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\fOImnGTmyV\src\obj\Debug\kjrN.pdb
Module Name
kjrN.exe
Full Name
kjrN.exe
EntryPoint
System.Void NetworkSniffer.Program::Main()
Scope Name
kjrN.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kjrN
Assembly Version
7.6.4.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
134
Main Method
System.Void NetworkSniffer.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void NetworkSniffer.MainUI::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙