Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

This sample is a 5.4 MB PE Executable identified by Malva.RE as .NET Reflective Loader (loader, crypter). Static analysis extracted 582 embedded or derived files. It matches 18 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091
MD5
106c94d5389cd09a776092507c2fca96
Verdict
Malicious
File type
PE Executable · 5.4 MB
Family
.NET Reflective Loader
Category
Loader, Crypter
MITRE ATT&CK
T1059.007

Cite this report: https://app.malva.re/sha256/847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
5.65 MB · 5,646,848 B
First seen
2026-10-28 11:00 · 4 days ago
Last seen
2026-10-28 11:00 · 4 days ago
Last analysis
2026-10-28 11:01 · 4 days ago
Hashes
MD5 106c94d5389cd09a776092507c2fca96 Sha1 d548deafacfb0ba5cbfef6c28759974a62d4f07a Sha256 847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091 Sha384 84f607cacb602e3af9f46ab4449bf2c67d7095e5718ef419a7e760cce184873e3f51079d151526ce8944ca781e89cb5a Sha512 dc91166f2ffbee6b0aa8518dcd1c04d3710a94a2171e49b8ce7725c8611c866717e332c763d760da9e7ac6159023635a1ab92de0d1f7d197ed03b91c566e4a8b SSDeep 98304:m4HXmKBm3513/itZ6vYbqiv0fRg9Q37PE4rm:m4Lm3P3/itZ6gWrg9Ibr TLSH 0046232B23C55A48D63E57F4843889C29BB17E4FAE11C31D79C9339C5E32296BB52723
Detection
Symbol obfuscation
Very high

2 malicious · 583 files
EXE106c94d5389cd09a776092507c2fca96.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEMaselatki.562567.tsx [AES Decrypted]
Structure
BIN.Net Resources
BINAttachedParser.TokenParser
BINOperationalParser.HiddenParser
BINDetachedParser.ParserFactory
BINParserEditor.ParserElement
BINOverlay_fef55cbd.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TSXMaselatki.562567.tsx
BIN6Rj_Ct3e4Jg.Resources.resources
BINd1eae1600f6dfc.Resources.resources
BIN8cfeb2f70
DATA[NBF]root.Data
BIN8cfeb2f71
DATA[NBF]root.Data
BIN8cfeb2f710
DATA[NBF]root.Data
BIN8cfeb2f7100
DATA[NBF]root.Data
BIN8cfeb2f7101
DATA[NBF]root.Data
BIN8cfeb2f7102
DATA[NBF]root.Data
BIN8cfeb2f7103
DATA[NBF]root.Data
BIN8cfeb2f7104
DATA[NBF]root.Data
BIN8cfeb2f7105
DATA[NBF]root.Data
BIN8cfeb2f7106
DATA[NBF]root.Data
BIN8cfeb2f7107
DATA[NBF]root.Data
BIN8cfeb2f7108
DATA[NBF]root.Data
BIN8cfeb2f7109
DATA[NBF]root.Data
BIN8cfeb2f711
DATA[NBF]root.Data
BIN8cfeb2f7110
DATA[NBF]root.Data
BIN8cfeb2f7111
DATA[NBF]root.Data
BIN8cfeb2f7112
DATA[NBF]root.Data
BIN8cfeb2f7113
DATA[NBF]root.Data
BIN8cfeb2f7114
DATA[NBF]root.Data
BIN8cfeb2f7115
DATA[NBF]root.Data
BIN8cfeb2f7116
DATA[NBF]root.Data
BIN8cfeb2f7117
DATA[NBF]root.Data
BIN8cfeb2f7118
DATA[NBF]root.Data
BIN8cfeb2f7119
DATA[NBF]root.Data
BIN8cfeb2f712
DATA[NBF]root.Data
BIN8cfeb2f7120
DATA[NBF]root.Data
BIN8cfeb2f7121
DATA[NBF]root.Data
BIN8cfeb2f7122
DATA[NBF]root.Data
BIN8cfeb2f7123
DATA[NBF]root.Data
BIN8cfeb2f7124
DATA[NBF]root.Data
BIN8cfeb2f7125
DATA[NBF]root.Data
BIN8cfeb2f7126
DATA[NBF]root.Data
BIN8cfeb2f7127
DATA[NBF]root.Data
BIN8cfeb2f7128
DATA[NBF]root.Data
BIN8cfeb2f7129
DATA[NBF]root.Data
BIN8cfeb2f713
DATA[NBF]root.Data
BIN8cfeb2f7130
DATA[NBF]root.Data
BIN8cfeb2f7131
DATA[NBF]root.Data
BIN8cfeb2f7132
DATA[NBF]root.Data
BIN8cfeb2f7133
DATA[NBF]root.Data
BIN8cfeb2f7134
DATA[NBF]root.Data
BIN8cfeb2f7135
DATA[NBF]root.Data
BIN8cfeb2f7136
DATA[NBF]root.Data
BIN8cfeb2f7137
DATA[NBF]root.Data
BIN8cfeb2f7138
DATA[NBF]root.Data
BIN8cfeb2f7139
DATA[NBF]root.Data
BIN8cfeb2f714
DATA[NBF]root.Data
BIN8cfeb2f7140
DATA[NBF]root.Data
BIN8cfeb2f7141
DATA[NBF]root.Data
BIN8cfeb2f7142
DATA[NBF]root.Data
BIN8cfeb2f7143
DATA[NBF]root.Data
BIN8cfeb2f7144
DATA[NBF]root.Data
BIN8cfeb2f7145
DATA[NBF]root.Data
BIN8cfeb2f7146
DATA[NBF]root.Data
BIN8cfeb2f7147
DATA[NBF]root.Data
BIN8cfeb2f7148
DATA[NBF]root.Data
BIN8cfeb2f7149
DATA[NBF]root.Data
BIN8cfeb2f715
DATA[NBF]root.Data
BIN8cfeb2f7150
DATA[NBF]root.Data
BIN8cfeb2f7151
DATA[NBF]root.Data
BIN8cfeb2f7152
DATA[NBF]root.Data
BIN8cfeb2f7153
DATA[NBF]root.Data
BIN8cfeb2f7154
DATA[NBF]root.Data
BIN8cfeb2f7155
DATA[NBF]root.Data
BIN8cfeb2f7156
DATA[NBF]root.Data
BIN8cfeb2f7157
DATA[NBF]root.Data
BIN8cfeb2f7158
DATA[NBF]root.Data
BIN8cfeb2f7159
DATA[NBF]root.Data
BIN8cfeb2f716
DATA[NBF]root.Data
BIN8cfeb2f7160
DATA[NBF]root.Data
BIN8cfeb2f7161
DATA[NBF]root.Data
BIN8cfeb2f7162
DATA[NBF]root.Data
BIN8cfeb2f7163
DATA[NBF]root.Data
BIN8cfeb2f7164
DATA[NBF]root.Data
BIN8cfeb2f7165
DATA[NBF]root.Data
BIN8cfeb2f7166
DATA[NBF]root.Data
BIN8cfeb2f7167
DATA[NBF]root.Data
BIN8cfeb2f7168
DATA[NBF]root.Data
BIN8cfeb2f7169
DATA[NBF]root.Data
BIN8cfeb2f717
DATA[NBF]root.Data
BIN8cfeb2f7170
DATA[NBF]root.Data
BIN8cfeb2f7171
DATA[NBF]root.Data
BIN8cfeb2f7172
DATA[NBF]root.Data
BIN8cfeb2f7173
DATA[NBF]root.Data
BIN8cfeb2f7174
DATA[NBF]root.Data
BIN8cfeb2f7175
DATA[NBF]root.Data
BIN8cfeb2f7176
DATA[NBF]root.Data
BIN8cfeb2f7177
DATA[NBF]root.Data
BIN8cfeb2f7178
DATA[NBF]root.Data
BIN8cfeb2f7179
DATA[NBF]root.Data
BIN8cfeb2f718
DATA[NBF]root.Data
BIN8cfeb2f7180
DATA[NBF]root.Data
BIN8cfeb2f7181
DATA[NBF]root.Data
BIN8cfeb2f7182
DATA[NBF]root.Data
BIN8cfeb2f7183
DATA[NBF]root.Data
BIN8cfeb2f7184
DATA[NBF]root.Data
BIN8cfeb2f7185
DATA[NBF]root.Data
BIN8cfeb2f7186
DATA[NBF]root.Data
BIN8cfeb2f7187
DATA[NBF]root.Data
BIN8cfeb2f7188
DATA[NBF]root.Data
BIN8cfeb2f7189
DATA[NBF]root.Data
BIN8cfeb2f719
DATA[NBF]root.Data
BIN8cfeb2f7190
DATA[NBF]root.Data
BIN8cfeb2f7191
DATA[NBF]root.Data
BIN8cfeb2f7192
DATA[NBF]root.Data
BIN8cfeb2f7193
DATA[NBF]root.Data
BIN8cfeb2f7194
DATA[NBF]root.Data
BIN8cfeb2f7195
DATA[NBF]root.Data
BIN8cfeb2f7196
DATA[NBF]root.Data
BIN8cfeb2f7197
DATA[NBF]root.Data
BIN8cfeb2f7198
DATA[NBF]root.Data
BIN8cfeb2f7199
DATA[NBF]root.Data
BIN8cfeb2f72
DATA[NBF]root.Data
BIN8cfeb2f720
DATA[NBF]root.Data
BIN8cfeb2f7200
DATA[NBF]root.Data
BIN8cfeb2f7201
DATA[NBF]root.Data
BIN8cfeb2f7202
DATA[NBF]root.Data
BIN8cfeb2f7203
DATA[NBF]root.Data
BIN8cfeb2f7204
DATA[NBF]root.Data
BIN8cfeb2f7205
DATA[NBF]root.Data
BIN8cfeb2f7206
DATA[NBF]root.Data
BIN8cfeb2f7207
DATA[NBF]root.Data
BIN8cfeb2f7208
DATA[NBF]root.Data
BIN8cfeb2f7209
DATA[NBF]root.Data
BIN8cfeb2f721
DATA[NBF]root.Data
BIN8cfeb2f7210
DATA[NBF]root.Data
BIN8cfeb2f7211
DATA[NBF]root.Data
BIN8cfeb2f7212
DATA[NBF]root.Data
BIN8cfeb2f7213
DATA[NBF]root.Data
BIN8cfeb2f7214
DATA[NBF]root.Data
BIN8cfeb2f7215
DATA[NBF]root.Data
BIN8cfeb2f7216
DATA[NBF]root.Data
BIN8cfeb2f7217
DATA[NBF]root.Data
BIN8cfeb2f7218
DATA[NBF]root.Data
BIN8cfeb2f7219
DATA[NBF]root.Data
BIN8cfeb2f722
DATA[NBF]root.Data
BIN8cfeb2f7220
DATA[NBF]root.Data
BIN8cfeb2f7221
DATA[NBF]root.Data
BIN8cfeb2f7222
DATA[NBF]root.Data
BIN8cfeb2f7223
DATA[NBF]root.Data
BIN8cfeb2f7224
DATA[NBF]root.Data
BIN8cfeb2f7225
DATA[NBF]root.Data
BIN8cfeb2f7226
DATA[NBF]root.Data
BIN8cfeb2f7227
DATA[NBF]root.Data
BIN8cfeb2f7228
DATA[NBF]root.Data
BIN8cfeb2f7229
DATA[NBF]root.Data
BIN8cfeb2f723
DATA[NBF]root.Data
BIN8cfeb2f7230
DATA[NBF]root.Data
BIN8cfeb2f7231
DATA[NBF]root.Data
BIN8cfeb2f7232
DATA[NBF]root.Data
BIN8cfeb2f7233
DATA[NBF]root.Data
BIN8cfeb2f7234
DATA[NBF]root.Data
BIN8cfeb2f7235
DATA[NBF]root.Data
BIN8cfeb2f7236
DATA[NBF]root.Data
BIN8cfeb2f7237
DATA[NBF]root.Data
BIN8cfeb2f7238
DATA[NBF]root.Data
BIN8cfeb2f7239
DATA[NBF]root.Data
BIN8cfeb2f724
DATA[NBF]root.Data
BIN8cfeb2f7240
DATA[NBF]root.Data
BIN8cfeb2f7241
DATA[NBF]root.Data
BIN8cfeb2f7242
DATA[NBF]root.Data
BIN8cfeb2f7243
DATA[NBF]root.Data
BIN8cfeb2f7244
DATA[NBF]root.Data
BIN8cfeb2f7245
DATA[NBF]root.Data
BIN8cfeb2f7246
DATA[NBF]root.Data
BIN8cfeb2f7247
DATA[NBF]root.Data
BIN8cfeb2f7248
DATA[NBF]root.Data
BIN8cfeb2f7249
DATA[NBF]root.Data
BIN8cfeb2f725
DATA[NBF]root.Data
BIN8cfeb2f7250
DATA[NBF]root.Data
BIN8cfeb2f7251
DATA[NBF]root.Data
BIN8cfeb2f7252
DATA[NBF]root.Data
BIN8cfeb2f7253
DATA[NBF]root.Data
BIN8cfeb2f7254
DATA[NBF]root.Data
BIN8cfeb2f7255
DATA[NBF]root.Data
BIN8cfeb2f7256
DATA[NBF]root.Data
BIN8cfeb2f7257
DATA[NBF]root.Data
BIN8cfeb2f7258
DATA[NBF]root.Data
BIN8cfeb2f7259
DATA[NBF]root.Data
BIN8cfeb2f726
DATA[NBF]root.Data
BIN8cfeb2f7260
DATA[NBF]root.Data
BIN8cfeb2f7261
DATA[NBF]root.Data
BIN8cfeb2f7262
DATA[NBF]root.Data
BIN8cfeb2f7263
DATA[NBF]root.Data
BIN8cfeb2f7264
DATA[NBF]root.Data
BIN8cfeb2f7265
DATA[NBF]root.Data
BIN8cfeb2f7266
DATA[NBF]root.Data
BIN8cfeb2f7267
DATA[NBF]root.Data
BIN8cfeb2f7268
DATA[NBF]root.Data
BIN8cfeb2f7269
DATA[NBF]root.Data
BIN8cfeb2f727
DATA[NBF]root.Data
BIN8cfeb2f7270
DATA[NBF]root.Data
BIN8cfeb2f7271
DATA[NBF]root.Data
BIN8cfeb2f7272
DATA[NBF]root.Data
BIN8cfeb2f7273
DATA[NBF]root.Data
BIN8cfeb2f7274
DATA[NBF]root.Data
BIN8cfeb2f7275
DATA[NBF]root.Data
BIN8cfeb2f7276
DATA[NBF]root.Data
BIN8cfeb2f7277
DATA[NBF]root.Data
BIN8cfeb2f7278
DATA[NBF]root.Data
BIN8cfeb2f7279
DATA[NBF]root.Data
BIN8cfeb2f728
DATA[NBF]root.Data
BIN8cfeb2f7280
DATA[NBF]root.Data
BIN8cfeb2f7281
DATA[NBF]root.Data
BIN8cfeb2f7282
DATA[NBF]root.Data
BIN8cfeb2f729
DATA[NBF]root.Data
BIN8cfeb2f73
DATA[NBF]root.Data
BIN8cfeb2f730
DATA[NBF]root.Data
BIN8cfeb2f731
DATA[NBF]root.Data
BIN8cfeb2f732
DATA[NBF]root.Data
BIN8cfeb2f733
DATA[NBF]root.Data
BIN8cfeb2f734
DATA[NBF]root.Data
BIN8cfeb2f735
DATA[NBF]root.Data
BIN8cfeb2f736
DATA[NBF]root.Data
BIN8cfeb2f737
DATA[NBF]root.Data
BIN8cfeb2f738
DATA[NBF]root.Data
BIN8cfeb2f739
DATA[NBF]root.Data
BIN8cfeb2f74
DATA[NBF]root.Data
BIN8cfeb2f740
DATA[NBF]root.Data
BIN8cfeb2f741
DATA[NBF]root.Data
BIN8cfeb2f742
DATA[NBF]root.Data
BIN8cfeb2f743
DATA[NBF]root.Data
BIN8cfeb2f744
DATA[NBF]root.Data
BIN8cfeb2f745
DATA[NBF]root.Data
BIN8cfeb2f746
DATA[NBF]root.Data
BIN8cfeb2f747
DATA[NBF]root.Data
BIN8cfeb2f748
DATA[NBF]root.Data
BIN8cfeb2f749
DATA[NBF]root.Data
BIN8cfeb2f75
DATA[NBF]root.Data
BIN8cfeb2f750
DATA[NBF]root.Data
BIN8cfeb2f751
DATA[NBF]root.Data
BIN8cfeb2f752
DATA[NBF]root.Data
BIN8cfeb2f753
DATA[NBF]root.Data
BIN8cfeb2f754
DATA[NBF]root.Data
BIN8cfeb2f755
DATA[NBF]root.Data
BIN8cfeb2f756
DATA[NBF]root.Data
BIN8cfeb2f757
DATA[NBF]root.Data
BIN8cfeb2f758
DATA[NBF]root.Data
BIN8cfeb2f759
DATA[NBF]root.Data
BIN8cfeb2f76
DATA[NBF]root.Data
BIN8cfeb2f760
DATA[NBF]root.Data
BIN8cfeb2f761
DATA[NBF]root.Data
BIN8cfeb2f762
DATA[NBF]root.Data
BIN8cfeb2f763
DATA[NBF]root.Data
BIN8cfeb2f764
DATA[NBF]root.Data
BIN8cfeb2f765
DATA[NBF]root.Data
BIN8cfeb2f766
DATA[NBF]root.Data
BIN8cfeb2f767
DATA[NBF]root.Data
BIN8cfeb2f768
DATA[NBF]root.Data
BIN8cfeb2f769
DATA[NBF]root.Data
BIN8cfeb2f77
DATA[NBF]root.Data
BIN8cfeb2f770
DATA[NBF]root.Data
BIN8cfeb2f771
DATA[NBF]root.Data
BIN8cfeb2f772
DATA[NBF]root.Data
BIN8cfeb2f773
DATA[NBF]root.Data
BIN8cfeb2f774
DATA[NBF]root.Data
BIN8cfeb2f775
DATA[NBF]root.Data
BIN8cfeb2f776
DATA[NBF]root.Data
BIN8cfeb2f777
DATA[NBF]root.Data
BIN8cfeb2f778
DATA[NBF]root.Data
BIN8cfeb2f779
DATA[NBF]root.Data
BIN8cfeb2f78
DATA[NBF]root.Data
BIN8cfeb2f780
DATA[NBF]root.Data
BIN8cfeb2f781
DATA[NBF]root.Data
BIN8cfeb2f782
DATA[NBF]root.Data
BIN8cfeb2f783
DATA[NBF]root.Data
BIN8cfeb2f784
DATA[NBF]root.Data
BIN8cfeb2f785
DATA[NBF]root.Data
BIN8cfeb2f786
DATA[NBF]root.Data
BIN8cfeb2f787
DATA[NBF]root.Data
BIN8cfeb2f788
DATA[NBF]root.Data
BIN8cfeb2f789
DATA[NBF]root.Data
BIN8cfeb2f79
DATA[NBF]root.Data
BIN8cfeb2f790
DATA[NBF]root.Data
BIN8cfeb2f791
DATA[NBF]root.Data
BIN8cfeb2f792
DATA[NBF]root.Data
BIN8cfeb2f793
DATA[NBF]root.Data
BIN8cfeb2f794
DATA[NBF]root.Data
BIN8cfeb2f795
DATA[NBF]root.Data
BIN8cfeb2f796
DATA[NBF]root.Data
BIN8cfeb2f797
DATA[NBF]root.Data
BIN8cfeb2f798
DATA[NBF]root.Data
BIN8cfeb2f799
DATA[NBF]root.Data
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll~T1059.007>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes

Name Value
Module Name
6Rj_Ct3e4Jg
Full Name
6Rj_Ct3e4Jg
EntryPoint
System.Void 6Rj_Ct3e4Jg.2Twzy7Bk::2MatKyr0w8Yk4()
Scope Name
6Rj_Ct3e4Jg
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
6Rj_Ct3e4Jg
Assembly Version
20.7.38.48
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1083
Main Method
System.Void 6Rj_Ct3e4Jg.2Twzy7Bk::2MatKyr0w8Yk4()
Main IL Instruction Count
51
Main IL 
nop <null>
nop <null>
ldc.i4.s 25
stloc.2 <null>
ldloc.2 <null>
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.3 <null>
ldloc.3 <null>
ldc.i4.0 <null>
ldstr 562567.tsx
stelem.ref <null>
ldloc.3 <null>
ldc.i4.1 <null>
ldc.i4 8848948
stloc.s V_4
ldloca.s V_4
call System.String System.Int32::ToString()
stelem.ref <null>
ldloc.3 <null>
ldc.i4.2 <null>
ldloc.3 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] 6Rj_Ct3e4Jg.5SmnqyL79/Qgs4n7nArp.mZa1L0f_5fRj::3RdkC(System.String)
stelem.ref <null>
ldloc.3 <null>
ldc.i4.3 <null>
ldloc.3 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 6Rj_Ct3e4Jg.7CtwWdr1::Tq6pmLr4W(System.Byte[])
stelem.ref <null>
ldloc.3 <null>
ldloc.2 <null>
call System.Void 6Rj_Ct3e4Jg.Aa3om0Ef2waHb/eKn4kb8Z0t.ax4Q2::Yet7wf6BH(System.Object[],System.Int32)
nop <null>
leave.s IL_0063: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_5
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0063: nop
nop <null>
ret <null>

2 malicious · 583 files
EXE106c94d5389cd09a776092507c2fca96.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEMaselatki.562567.tsx [AES Decrypted]
Structure
BINOverlay_fef55cbd.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙