Malicious
Malicious

136ca5b8004081447e77bf913217dfe1

PE Executable
MD5: 136ca5b8004081447e77bf913217dfe1
Size: 638.98 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 624 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 8 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
cbaba548a82efa8f454110a3ccfa084de17504ea5f0abc9e48fda756377982aa
MD5
136ca5b8004081447e77bf913217dfe1
Verdict
Malicious
File type
PE Executable · 624 KB

Cite this report: https://app.malva.re/sha256/cbaba548a82efa8f454110a3ccfa084de17504ea5f0abc9e48fda756377982aa

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
638.98 KB · 638,976 B
First seen
2026-10-26 09:45 · 3 hours ago
Last seen
2026-10-26 09:45 · 3 hours ago
Last analysis
2026-10-26 09:45 · 3 hours ago
Hashes
MD5 136ca5b8004081447e77bf913217dfe1 Sha1 2b3e98e8d9e5a0a1d8eae8c9deb76d2a197db326 Sha256 cbaba548a82efa8f454110a3ccfa084de17504ea5f0abc9e48fda756377982aa Sha384 9073342948a500915009a3d164fa7adf752bfbcf36381e91dcb6c63f1c309387ee4445ec7c154fbc6efec0c59ba94ebe Sha512 055a57c18adb01aa1e4e7e647dc43a42197b553d1bc99645489ab1e968e17cee6586939b658bb74eadb8a3b640afbfa50d4b10342c7e341239fa7b76ffeb68de SSDeep 12288:mGqmxTF/PnvPN1UDh8RESi+5ShhvKlr8nJnjKQ92:5R/vHXiwIHhpKlr8tKQ92 TLSH 04D49DA7765A8D20D1C41333D5DF990053B16592BAA7FB0F35C813E925473EAEE0B2A3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 9 files
EXE136ca5b8004081447e77bf913217dfe1
Structure
BIN.Net Resources
BIN0swpTGQ952CZLKGsJ4.6BRhGb3PBBgNMYv5ig
BIN7mGYarsummww3iW23P.ORpamrEp6crjsjvW16
BINuv1qb2aJ4ck67HL5yR.hOPk0g4W4tRGUsv9mr
BINGucdzpccogg.g.resources
BINRfzjvmia.Properties.Resources.resources
BINHnnoan
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Gucdzpccogg.exe
Full Name
Gucdzpccogg.exe
EntryPoint
System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::iK7yA3nPm()
Scope Name
Gucdzpccogg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gucdzpccogg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::iK7yA3nPm()
Main IL Instruction Count
113
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0009: ldloc V_2
br IL_002E: nop
ret <null>
nop <null>
nop <null>
ldsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/<>O::ajE0pXS5A
dup <null>
brfalse IL_0040: pop
br IL_00F6: call System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::JFBu5iDd0(System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>)
pop <null>
ldc.i4 9
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_4482f995ad7c4b0cb2565708177f48ad
brtrue IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
pop <null>
ldc.i4 1
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 10
beq IL_00D4: ldc.i4.0
ldloc V_0
ldc.i4 990
beq IL_006E: ldloc V_0
br IL_0105: leave IL_002D
ldsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::EapXNtsp5
ldnull <null>
ldc.i4.0 <null>
newobj System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>::Invoke(System.Object,T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF)
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_9a65b9f34bcf494f8bd7ad09d6212ace
brtrue IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
pop <null>
ldc.i4 8
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
ldc.i4.0 <null>
stsfld System.Int32 T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::Y9gYh8Dwv
ldc.i4 2
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
ldnull <null>
ldftn System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::mTybbHpSW(System.Object,System.Object)
newobj System.Void System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/<>O::ajE0pXS5A
call System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::JFBu5iDd0(System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>)
ldc.i4 10
br IL_006A: stloc V_0
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_b3798f87261741e0a0f424cfdb833957
brtrue IL_013C: switch(IL_0158)
pop <null>
ldc.i4 1
br IL_013C: switch(IL_0158)
br IL_0138: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0138: ldloc V_1
br IL_0158: leave IL_002D
leave IL_002D: ret
ldnull <null>
stsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::EapXNtsp5
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_c3553e139aba4928b29ab385d0331469
brfalse IL_0194: switch(IL_01B4,IL_01D9)
pop <null>
ldc.i4 4
br IL_0194: switch(IL_01B4,IL_01D9)
br IL_0190: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0190: ldloc V_3
br IL_01B4: ldnull
ldnull <null>
stsfld System.Object T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::NuQP2lktC
ldc.i4 7
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_8a6d3ea4e1ae45db90820d8f9493992d
brfalse IL_0194: switch(IL_01B4,IL_01D9)
pop <null>
ldc.i4 1
br IL_0194: switch(IL_01B4,IL_01D9)
endfinally <null>
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_9b043d1abffd445084f10997aa28720b
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 5
br IL_000D: switch(IL_002D,IL_002E)
Module Name
Gucdzpccogg.exe
Full Name
Gucdzpccogg.exe
EntryPoint
System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::iK7yA3nPm()
Scope Name
Gucdzpccogg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gucdzpccogg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::iK7yA3nPm()
Main IL Instruction Count
113
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0009: ldloc V_2
br IL_002E: nop
ret <null>
nop <null>
nop <null>
ldsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/<>O::ajE0pXS5A
dup <null>
brfalse IL_0040: pop
br IL_00F6: call System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::JFBu5iDd0(System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>)
pop <null>
ldc.i4 9
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_4482f995ad7c4b0cb2565708177f48ad
brtrue IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
pop <null>
ldc.i4 1
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 10
beq IL_00D4: ldc.i4.0
ldloc V_0
ldc.i4 990
beq IL_006E: ldloc V_0
br IL_0105: leave IL_002D
ldsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::EapXNtsp5
ldnull <null>
ldc.i4.0 <null>
newobj System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>::Invoke(System.Object,T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF)
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_9a65b9f34bcf494f8bd7ad09d6212ace
brtrue IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
pop <null>
ldc.i4 8
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
ldc.i4.0 <null>
stsfld System.Int32 T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::Y9gYh8Dwv
ldc.i4 2
br IL_0072: switch(IL_0105,IL_00E4,IL_00A4)
ldnull <null>
ldftn System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::mTybbHpSW(System.Object,System.Object)
newobj System.Void System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/<>O::ajE0pXS5A
call System.Void T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::JFBu5iDd0(System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF>)
ldc.i4 10
br IL_006A: stloc V_0
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_b3798f87261741e0a0f424cfdb833957
brtrue IL_013C: switch(IL_0158)
pop <null>
ldc.i4 1
br IL_013C: switch(IL_0158)
br IL_0138: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0138: ldloc V_1
br IL_0158: leave IL_002D
leave IL_002D: ret
ldnull <null>
stsfld System.EventHandler`1<T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw/XWnKRZqexhDSvE4bjF> T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::EapXNtsp5
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_c3553e139aba4928b29ab385d0331469
brfalse IL_0194: switch(IL_01B4,IL_01D9)
pop <null>
ldc.i4 4
br IL_0194: switch(IL_01B4,IL_01D9)
br IL_0190: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0190: ldloc V_3
br IL_01B4: ldnull
ldnull <null>
stsfld System.Object T1jFZq2qtSOALIFQD9.zCM4rwrIeJIu6kn6tw::NuQP2lktC
ldc.i4 7
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_8a6d3ea4e1ae45db90820d8f9493992d
brfalse IL_0194: switch(IL_01B4,IL_01D9)
pop <null>
ldc.i4 1
br IL_0194: switch(IL_01B4,IL_01D9)
endfinally <null>
ldc.i4 0
ldsfld <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc} <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_ca7378f4473948fc84fc579020725b66
ldfld System.Int32 <Module>{c93d2cf8-ef04-402c-9540-8259c3e067fc}::m_9b043d1abffd445084f10997aa28720b
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 5
br IL_000D: switch(IL_002D,IL_002E)

1 malicious · 9 files
EXE136ca5b8004081447e77bf913217dfe1
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙