Suspicious
Suspect

17c4d6e51c52e59ada1d644411d33015

Share on LinkedIn
Print
PE Executable
MD5: 17c4d6e51c52e59ada1d644411d33015
Size: 822.27 KB
application/x-dosexec

This sample is a 803 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
MD5
17c4d6e51c52e59ada1d644411d33015
Verdict
Inconclusive
File type
PE Executable · 803 KB

Cite this report: https://app.malva.re/sha256/3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
822.27 KB · 822,272 B
First seen
2026-10-09 04:45 · 23 days ago
Last seen
2026-10-09 04:45 · 23 days ago
Last analysis
2026-10-09 04:45 · 23 days ago
Hashes
MD5 17c4d6e51c52e59ada1d644411d33015 Sha1 86ca4d6d00752507b1f12faf1bb55af0a6ec5db1 Sha256 3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617 Sha384 623cadd15751fdeb367c591cbc3dc294009cf2c8d2eed681c63855c93b7006f14dbe49e17a9f929ff56e45abd057f187 Sha512 a6f9d7ef2eb0857ee31fc808ad684a7dd383e424d1ae2771004935f5749277c5cfde032fe65ece9200fd881713bfa8c8f9314634f8cdcaefe2c829a6d9205f1a SSDeep 12288:J0qG0iBn3vu6SZzpX8zm/ntg9UlmygxJNl6qBgkZzE6tGOxyS+Cob0YmKO:bQB3vtKX8Mt+ygxkql4q0bbJO TLSH D005DF00326BCD13D1B65BB106E1D3708BB42E95E622D3978FE66EE77A267C158C0793
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

16 files
EXE17c4d6e51c52e59ada1d644411d33015
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
Hhdl.exe
Full Name
Hhdl.exe
EntryPoint
System.Void C3.HC::P8()
Scope Name
Hhdl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Hhdl
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
728
Main Method
System.Void C3.HC::P8()
Main IL Instruction Count
15
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_000B: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0019: call System.Void zp6.op4::Wty()
nop <null>
ret <null>
call System.Void zp6.op4::Wty()
br IL_0023: nop
nop <null>
newobj System.Void l4.wP::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0017: nop
Module Name
Hhdl.exe
Full Name
Hhdl.exe
EntryPoint
System.Void C3.HC::P8()
Scope Name
Hhdl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Hhdl
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
728
Main Method
System.Void C3.HC::P8()
Main IL Instruction Count
15
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_000B: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0019: call System.Void zp6.op4::Wty()
nop <null>
ret <null>
call System.Void zp6.op4::Wty()
br IL_0023: nop
nop <null>
newobj System.Void l4.wP::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0017: nop

An error has occurred. This application may no longer respond until reloaded. Reload 🗙