Suspicious
Suspect

d11ea15f2c690f46bfc282f300f692c1

PE Executable
MD5: d11ea15f2c690f46bfc282f300f692c1
Size: 207.36 KB
application/x-dosexec

This sample is a 202.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 8 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
cfa1674a075c651c7bf0278f5fffc2ed2d268f4317eb41faf1d1eb03c14bdb04
MD5
d11ea15f2c690f46bfc282f300f692c1
Verdict
Inconclusive
File type
PE Executable · 202.5 KB

Cite this report: https://app.malva.re/sha256/cfa1674a075c651c7bf0278f5fffc2ed2d268f4317eb41faf1d1eb03c14bdb04

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
207.36 KB · 207,360 B
First seen
2026-06-29 15:30 · 4 months ago
Last seen
2026-06-29 15:30 · 4 months ago
Last analysis
2026-06-30 19:00 · 4 months ago
Hashes
MD5 d11ea15f2c690f46bfc282f300f692c1 Sha1 999dbc13a581e26dd6e2931db152b01087d13c92 Sha256 cfa1674a075c651c7bf0278f5fffc2ed2d268f4317eb41faf1d1eb03c14bdb04 Sha384 66ed3096bd2f3e6f6d1237f35b8cc2ced81affc187dd8859ff8f19088096a849ba1ff81a75fdd48a00018a06fa3e856d Sha512 006844f8e2ddff6fa51efcc74af68bbf4522cef7b8be25a06ffa0e08aa8cfd7a9263fc0e4f253e11031ab223f0a4e676f5f6b77402924afda71fff82aae4a16d SSDeep 3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HICC5fUisD1NHmB5n7lnQidogwf:gLV6Bta6dtJmakIM5IjsDM5nZQi+nf TLSH 8E14CF6637E84A2FE2CE8579611252139379C2E3D8C3F7DE68D464B38B667E10A071D3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

4 files
EXEd11ea15f2c690f46bfc282f300f692c1
Structure
BINResources
BINRT_RCDATA
BINID:0001
BINID:0
BIN.Net Resources
BINClientLoaderForm.resources
BIN          

Name Value
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

4 files
EXEd11ea15f2c690f46bfc282f300f692c1
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙