Sign up free
Suspicious
Suspect

fd328284a53017f477a2e8fb385a2ea2

Share on LinkedIn
Print
PE Executable
MD5: fd328284a53017f477a2e8fb385a2ea2
Size: 207.87 KB
application/x-dosexec

This sample is a 203 KB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 3 embedded or derived files. It matches 9 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
09f7d2a30633ca2ea229ae07d447819d96c19f1466021fb9c46a1fd241cf4ecf
MD5
fd328284a53017f477a2e8fb385a2ea2
Verdict
No known threat found
File type
PE Executable · 203 KB

Cite this report: https://app.malva.re/sha256/09f7d2a30633ca2ea229ae07d447819d96c19f1466021fb9c46a1fd241cf4ecf

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
207.87 KB · 207,872 B
First seen
2026-11-02 08:00 · 20 hours ago
Last seen
2026-11-02 08:00 · 20 hours ago
Last analysis
2026-11-02 08:00 · 20 hours ago
Hashes
MD5 fd328284a53017f477a2e8fb385a2ea2 Sha1 4f5cc06225be87c7ef5e827e2d3cd08966014def Sha256 09f7d2a30633ca2ea229ae07d447819d96c19f1466021fb9c46a1fd241cf4ecf Sha384 1d65cb7af7c587c1049548fc61b34ad63b205586d2bb73a0b061b502a893da8a1dabfebd24dc58f122a9374f03de857d Sha512 24871e299f2ff8868060359d57da4d030e8e54db9b041d62d60443b1b472df775b6f3e25e03a32e23ff3eaa867a07c2ff74dc56921bd3e87d6abd0b802d62547 SSDeep 6144:MLV6Bta6dtJmakIM5YMluAJDAxGJg09osR:MLV6BtpmkfRAioJgzu TLSH 3E14CF1A77A84A2FE2DE89B9601212579379C2E3D8C3F3EF28D455B34B263E506071D3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

4 files
EXEfd328284a53017f477a2e8fb385a2ea2
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
NanoCore Client.exe
Full Name
NanoCore Client.exe
EntryPoint
System.Void ClientLoaderForm::Main()
Scope Name
NanoCore Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NanoCore Client
Assembly Version
1.2.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void ClientLoaderForm::Main()
Main IL Instruction Count
4
Main IL 
call #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw== #=q_jQLaNdtSDa6ovA0VGw50w==::#=qqROT7DfncW7strhZvp0iRQ==()
callvirt ClientLoaderForm #=q_jQLaNdtSDa6ovA0VGw50w==/#=qlsj4Kl0M6SYgZMJLZ$QkSw==::#=qbzig1$2CwLluEJt5uPtpgqPx5y_2S$GoPgJP36N8bTE=()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙