Suspicious
Suspect

0a658f79a04be1f9ec69d742661c0a58

Disk Image
MD5: 0a658f79a04be1f9ec69d742661c0a58
Size: 825.34 KB

This sample is a 806 KB Disk Image for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 35 embedded or derived files. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
c189d6a23a412aeabdb65e6ce77cee8632323bbc70c44435c2940d8725c69a01
MD5
0a658f79a04be1f9ec69d742661c0a58
Verdict
Inconclusive
File type
Disk Image · 806 KB

Cite this report: https://app.malva.re/sha256/c189d6a23a412aeabdb65e6ce77cee8632323bbc70c44435c2940d8725c69a01

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Disk image
Size
825.34 KB · 825,344 B
First seen
2026-10-24 20:45 · 3 days ago
Last seen
2026-10-24 20:45 · 3 days ago
Last analysis
2026-10-24 20:45 · 3 days ago
Hashes
MD5 0a658f79a04be1f9ec69d742661c0a58 Sha1 4a23463dcf59c250e51f8d54cd0d1a2ce322b442 Sha256 c189d6a23a412aeabdb65e6ce77cee8632323bbc70c44435c2940d8725c69a01 Sha384 d8b4fe515c2c9f55a6f577adf7261d261f647f7d645f95813231947bc4155dac0e23b669d77a6f0dd64d8bc083f69c49 Sha512 131bcaccc121473e5b260471842bdc829982564ac8c086b8ca064fbff827588633abaad1259bf467b1853648a75b321ebbf4650ce73f14012b53f1b807b5ed08 SSDeep 12288:J9peKPmY3fWQ+W1oDGLuLmdpl1kk5gNXT/AF9jc:JvJdWQq6LjflK4gloL TLSH 0D052211B8D0AB67C41A027A5006E30C5373DC48AFBA4447BAADF7191B7BF12D565BF2

36 files
ISO0a658f79a04be1f9ec69d742661c0a58
EXEAidaDrvF
Structure
P7B[Authenticode]_26136b40.p7b
EXENbdF
BINNiDrvF
BINSt0F
OFFAdobe Installer.msi
BINRoot Entry
BIN䡀䌏䈯
BIN䄧䄷䆾䅤
EXENbdF
Structure
EXENiDrvF
Structure
P7B[Authenticode]_8497cb79.p7b
BINResources
BINRT_MESSAGETABLE
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXESt0F
Structure
BIN䡀䈖䌧䠤
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䈛䌪䗶䜵
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䈜䙵䆬㬨䑲䕷䏲
BIN䡀䈜䙵䆬㲨䖱䄷䏯
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINSummaryInformation
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
bin 5

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path img:disk>ole:doc>bin>pe:exe
Shape img:disk>ole:doc>bin>pe:exe
4 nodes
Path img:disk>pe:exe
Shape img:disk>pe:exe
2 nodes

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

36 files
ISO0a658f79a04be1f9ec69d742661c0a58
EXENbdF
BINNiDrvF
BINSt0F
No malware configuration was found at this point.

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
0a658f79a04be1f9ec69d742661c0a58 › NbdF
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙