Malicious
Malicious

101719e040f290eb6f49de7b6237bbf6

Share on LinkedIn
Print
PE Executable
MD5: 101719e040f290eb6f49de7b6237bbf6
Size: 432.64 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 422.5 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
75c9a2ac2c26e0e0cdd90e3772515dd197098b94be2660bcf9b94ac161c92743
MD5
101719e040f290eb6f49de7b6237bbf6
Verdict
Malicious
File type
PE Executable · 422.5 KB

Cite this report: https://app.malva.re/sha256/75c9a2ac2c26e0e0cdd90e3772515dd197098b94be2660bcf9b94ac161c92743

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
432.64 KB · 432,640 B
First seen
2026-11-01 07:00 · 2 hours ago
Last seen
2026-11-01 07:00 · 2 hours ago
Last analysis
2026-11-01 07:00 · 2 hours ago
Hashes
MD5 101719e040f290eb6f49de7b6237bbf6 Sha1 6a6734d16124a9f659ee5f157f5cf528f008dcf1 Sha256 75c9a2ac2c26e0e0cdd90e3772515dd197098b94be2660bcf9b94ac161c92743 Sha384 4374e9cfdd7d94b7582981a62b057dcb265109a6081526502939bea9abf1e2663056dd52ee8e1234bb033a25fa175202 Sha512 149c3121c304e6ef46ab07a97c6c04f734ba4fc3b0100c4472374104e0e72008e99e1bcff317bb587717a18a5e431dd1c1d900892c29d8713555cdb58e9a36f6 SSDeep 6144:90dYG4OGv8m6zPqe04bNsOPZcGNCu2k21csVLsnuabmcnNEx37Av:W94RizPqT4bC2cyekAMnuaox37k TLSH E5945C6673564E11E2899337C0CF494083EAA7827AB7E70F778413E919027EEDE06797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE101719e040f290eb6f49de7b6237bbf6
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Gysuusfqym.exe
Full Name
Gysuusfqym.exe
EntryPoint
System.Void L3Gid5khFIA4C461tm.hWf8ksP8srfUWGKcD1::xEO78GkeF()
Scope Name
Gysuusfqym.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gysuusfqym
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3Gid5khFIA4C461tm.hWf8ksP8srfUWGKcD1::xEO78GkeF()
Main IL Instruction Count
65
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ldsfld XR5k4CUhWfqQZ4rckyd XR5k4CUhWfqQZ4rckyd::d5uUnNsli9
ldsfld XR5k4CUhWfqQZ4rckyd XR5k4CUhWfqQZ4rckyd::d5uUnNsli9
call System.Void XR5k4CUhWfqQZ4rckyd::B1KUPHh7EH(XR5k4CUhWfqQZ4rckyd)
ldc.i4 1
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_96e875c3a42743aebe99f3a277e73525
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld xpVP0AUID0I0tWW4Wlv xpVP0AUID0I0tWW4Wlv::efuUsellpC
call System.Void xpVP0AUID0I0tWW4Wlv::B1KUPHh7EH(xpVP0AUID0I0tWW4Wlv)
ldc.i4 0
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_3340f97e05d1498ebdd2a407505acb79
brtrue IL_009E: switch(IL_00BA)
pop <null>
ldc.i4 3
br IL_009E: switch(IL_00BA)
br IL_009A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_009A: ldloc V_0
br IL_00BA: leave IL_0061
leave IL_0061: ret
pop <null>
ldc.i4 4
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_5232e78692ba4b3ab3757e7a4d15360e
brfalse IL_00F1: switch(IL_010D)
pop <null>
ldc.i4 0
br IL_00F1: switch(IL_010D)
br IL_00ED: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00ED: ldloc V_1
br IL_010D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_4b5f0620f7c64b3f8c03e6cefac5e9d0
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
Module Name
Gysuusfqym.exe
Full Name
Gysuusfqym.exe
EntryPoint
System.Void L3Gid5khFIA4C461tm.hWf8ksP8srfUWGKcD1::xEO78GkeF()
Scope Name
Gysuusfqym.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gysuusfqym
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3Gid5khFIA4C461tm.hWf8ksP8srfUWGKcD1::xEO78GkeF()
Main IL Instruction Count
65
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ldsfld XR5k4CUhWfqQZ4rckyd XR5k4CUhWfqQZ4rckyd::d5uUnNsli9
ldsfld XR5k4CUhWfqQZ4rckyd XR5k4CUhWfqQZ4rckyd::d5uUnNsli9
call System.Void XR5k4CUhWfqQZ4rckyd::B1KUPHh7EH(XR5k4CUhWfqQZ4rckyd)
ldc.i4 1
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_96e875c3a42743aebe99f3a277e73525
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld xpVP0AUID0I0tWW4Wlv xpVP0AUID0I0tWW4Wlv::efuUsellpC
call System.Void xpVP0AUID0I0tWW4Wlv::B1KUPHh7EH(xpVP0AUID0I0tWW4Wlv)
ldc.i4 0
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_3340f97e05d1498ebdd2a407505acb79
brtrue IL_009E: switch(IL_00BA)
pop <null>
ldc.i4 3
br IL_009E: switch(IL_00BA)
br IL_009A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_009A: ldloc V_0
br IL_00BA: leave IL_0061
leave IL_0061: ret
pop <null>
ldc.i4 4
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_5232e78692ba4b3ab3757e7a4d15360e
brfalse IL_00F1: switch(IL_010D)
pop <null>
ldc.i4 0
br IL_00F1: switch(IL_010D)
br IL_00ED: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00ED: ldloc V_1
br IL_010D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885} <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_2b65a83957da4f61a9fdb04bd26234ca
ldfld System.Int32 <Module>{7fe3da33-905a-4b7f-b17b-c7f93cd73885}::m_4b5f0620f7c64b3f8c03e6cefac5e9d0
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0061,IL_0062,IL_0038)

An error has occurred. This application may no longer respond until reloaded. Reload 🗙