Suspect
PE Executable
MD5: 0c85502f530265db7ccc165cae101670
Size: 1.71 MB
application/x-dosexec
This sample is a 1.6 MB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature among its 403 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.
- SHA256
- 4b1c1cd5ed4c6bd04a13d4ba47fef589956b99de3f10ae5393eb7e0d7ad81b30
- MD5
- 0c85502f530265db7ccc165cae101670
- Verdict
- No known threat found
- File type
- PE Executable · 1.6 MB
Cite this report: https://app.malva.re/sha256/4b1c1cd5ed4c6bd04a13d4ba47fef589956b99de3f10ae5393eb7e0d7ad81b30
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
1.71 MB · 1,714,688 B
First seen
2026-10-22 01:30 · 12 days ago
Last seen
2026-10-22 01:30 · 12 days ago
Last analysis
2026-10-22 01:35 · 12 days ago
Hashes
MD5
0c85502f530265db7ccc165cae101670
Sha1
1a282f7e57bf169a27026df2c8392d56cd0658fc
Sha256
4b1c1cd5ed4c6bd04a13d4ba47fef589956b99de3f10ae5393eb7e0d7ad81b30
Sha384
7e29fb6d4f955be1b42308705ba1626218b9fd65faa67a60e31f803a76294b0fcaebfb53e948f72b1541354b5e5a9caa
Sha512
f93e79e1cc8a094fb8d37b203f3bb55d9528a5ece2fe0c2802f51afbbcf1b1bb8ae430b8e5760a554ea9950dd6a4e40c084e42a7a3d965ba8b5a0675fdc88a0b
SSDeep
24576:XRsINLnmijIOMNRRpjzfkk7+vfYxKVBDtSroYAHgiahwoMdkTwCyV8uFxkW8D1vA:XkjzOgrh6oMe9q8D14
TLSH
9C852950FDDB24B1EA06153109A762BF2331AD094F35CBCBD944BB79EC73AE10972629
Detection
PeID
Microsoft Visual C++ v6.0 DLLPeStubOEP v1.xPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!
1 file
EXE0c85502f530265db7ccc165cae101670
Structure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
1 nodes