The nano exe File Malware Analysis

Technical Analysis

File Name	nano.exe
File Type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version	1.0.213.174
Database Version	2025-04-11 18:00:21 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	9180a48695842dfabb743ade648a37b8
SHA1	b75a36cc2f849dd4daa7f13eb20edb7ea6506e47
SHA256	0a45c8faa7ae4e9baa065bbd428aab3fc3cbd8dd21b8909dfcc64c4fef843506
SHA512	24d73286399cc98d8ef09671b92fc3d5623e5eeea6f45eb18193481a91b439d9ca852da7f546bb670ffde480bfc25ddcae138e46fa04c0bad2173c5b78b3d552
ImpHash	9b8803146898abeba0161d0c900da6e2

PE Analysis

Basic Information

▼

Image Base	`0x00400000`
Entry Point	`0x00401460`
Compilation Time	2025-04-02 13:13:05
Checksum	0x00101a92 (Actual: 0x00101a92)
OS Version	4.0
PEiD Signatures	`PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	7 libraries bcrypt, KERNEL32, msvcrt, ntdll, SHELL32, SHLWAPI, USER32
Exports	0 functions
Resources	1 Resources
Sections	9 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	679,584 bytes	679,936 bytes	6.26 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`84401124569B180CB2F0F123E0BF3D04`
`.data`	`0x000a7000`	2,976 bytes	3,072 bytes	2.64 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`371EAA6D1BBC6342F60001ED3DA5D466`
`.rdata`	`0x000a8000`	204,652 bytes	204,800 bytes	4.98 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`93B4B4495F94C917135D9FB96A577C18`
`/4`	`0x000da000`	94,148 bytes	94,208 bytes	5.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8B8C20613668F5CCEBF74223C2FC186D`
`.bss`	`0x000f1000`	9,688 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000f4000`	6,580 bytes	6,656 bytes	5.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6B888A8CA833A5BE736856F015D66413`
`.tls`	`0x000f6000`	8 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x000f7000`	1,256 bytes	1,536 bytes	4.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A20A8B5CF98038AE75ED33363062D7C8`
`.reloc`	`0x000f8000`	32,520 bytes	32,768 bytes	6.73 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`5A3556D9131852566559DFDCED995802`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (1,167 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	1,167 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The nano.exe File Analysis