Suspect
PE Executable
MD5: 0ec5c9d3db89de00830cd917920d6ff6
Size: 6.3 MB
application/x-dosexec
This sample is a 6 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 520356aeba042e45c38895485769d92293ec2072abe8188dee1fb3f995ced3e2
- MD5
- 0ec5c9d3db89de00830cd917920d6ff6
- Verdict
- Inconclusive
- File type
- PE Executable · 6 MB
Cite this report: https://app.malva.re/sha256/520356aeba042e45c38895485769d92293ec2072abe8188dee1fb3f995ced3e2
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
6.3 MB · 6,303,232 B
First seen
2026-09-14 13:30 · one month ago
Last seen
2026-09-14 13:30 · one month ago
Last analysis
2026-09-14 13:31 · one month ago
Hashes
MD5
0ec5c9d3db89de00830cd917920d6ff6
Sha1
e52ec036d076267a39dbf685f20338ff1eb0a0c8
Sha256
520356aeba042e45c38895485769d92293ec2072abe8188dee1fb3f995ced3e2
Sha384
22fefdf3c0e315b069c28cea76bfe05d2895e3e61ea29472e7c499056aade390791db5c6bd53fb5bd63cccfd946fe7da
Sha512
d7793cbd95ae82e6e90ff6401b4f2487ba45c23953be5a3d98acd01a891429e499f2cf98d997f3a2209762853cb89428f47bd645c382f505725ea0573d99e146
SSDeep
196608:X6qYMMmkPpPHHMAtpItuIybc81tCQYdSIevBaPS:XYMMmkxtpc2CQYAIevBaP
TLSH
295633684FD8D963CEC4137DF86F5F984A37831851A926087068AE32435F66DEE1BB31
Detection
PeID
RPolyCryptor V1.4.2 -> VaskaUPolyX 0.3 -> delikonx64 Themida / Winlicense v3.0.x.0 PACKED sign ASL
1 file
EXE0ec5c9d3db89de00830cd917920d6ff6
Structure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe
Shape
pe:exe
1 nodes