Suspicious
Suspect

01b387058c620a886b116c990fa5c5bb

PE Executable
MD5: 01b387058c620a886b116c990fa5c5bb
Size: 27.06 MB
application/x-dosexec

This sample is a 25.8 MB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature among its 403 YARA rules. Static analysis extracted 43 embedded or derived files. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
f6d6154a59148cfa484aa6b73b29d6c762f2c3f1b1060ee2fde764b280443dd9
MD5
01b387058c620a886b116c990fa5c5bb
Verdict
No known threat found
File type
PE Executable · 25.8 MB

Cite this report: https://app.malva.re/sha256/f6d6154a59148cfa484aa6b73b29d6c762f2c3f1b1060ee2fde764b280443dd9

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
27.06 MB · 27,062,968 B
First seen
2026-10-22 05:45 · 13 days ago
Last seen
2026-10-22 05:45 · 13 days ago
Last analysis
2026-10-22 05:46 · 13 days ago
Hashes
MD5 01b387058c620a886b116c990fa5c5bb Sha1 e418811201a414e7b3285e5b451a4b2bc3e8c851 Sha256 f6d6154a59148cfa484aa6b73b29d6c762f2c3f1b1060ee2fde764b280443dd9 Sha384 736f91a0ac1b88b49ba0c84f8f5aeed96a74a57f78f59f98af8ed3776d67db2e8f8b757eaa2799eeb1e9ad184a5d80e2 Sha512 a1766f21e9105e5ff12f89e6351362e7977219358c5637554d36224977830dc0b440190c2c51ddcde2c010393f129b8e22a5dd625c4d6dde8e31d97a7ebb7590 SSDeep 393216:oIZON7T52Psae3fH/Yf22fqRVNHx9lc+i738E6bZyVw3WT1YsWLa:9I7cefwfMRVNHx9lC8HbZyVw3y1Ysaa TLSH 0B57B051B30B05F6FF434C3645FAAB2F7B39E2DC8974C55AE4282426BAA2C1F45DC291
Detection
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikon

23 files
EXE01b387058c620a886b116c990fa5c5bb
Structure
P7B[Authenticode]_24bd65c5.p7b
BINResources
BINRT_ICON
BINID:0000
BINID:1033
Structure
BINOverlay_d1f3b543.bin
BIN(folder)
BIN4
BIN19
BIN31
BIN45
BIN57
BIN70
BIN81
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 2

Name Value
Info
Authenticode present at 0x19CEC00 size 1720 bytes

23 files
EXE01b387058c620a886b116c990fa5c5bb
Structure
P7B[Authenticode]_24bd65c5.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙