Malicious
Malicious

1bb536a4baf42af61d08306cc89e93af

PE Executable
MD5: 1bb536a4baf42af61d08306cc89e93af
Size: 1.7 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 1.6 MB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 9 embedded or derived files. It matches 9 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4
MD5
1bb536a4baf42af61d08306cc89e93af
Verdict
No known threat found
File type
PE Executable · 1.6 MB

Cite this report: https://app.malva.re/sha256/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.7 MB · 1,699,347 B
First seen
2026-11-01 11:45 · 2 days ago
Last seen
2026-11-01 11:45 · 2 days ago
Last analysis
2026-11-01 11:46 · 2 days ago
Hashes
MD5 1bb536a4baf42af61d08306cc89e93af Sha1 888301bc8f419c07364af1f60e3e38c8c544504b Sha256 0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4 Sha384 a5fed313594b143cac76796b1034dd2d8fc3fdd8e9c4232b5964ae3ac3badda45a2aeb2a8d64f8aeb3fa444de104dbf1 Sha512 7acbeed81667e05836c6a59f113d1c40f56a27002eba8af512bc237d0a2525d3350acd46b8cb949d82e91ee9cc493b3fbfef72680a32fec0fc949e2c58bf61f6 SSDeep 49152:Gu9j+BFJ0TH/RTdlgN3GpZbu/I6ICOLx2F+mnvMBk0XdZGnT2Cq5:GWCBFJG/lP6ICOLx2F+mnvMBk0XdZGnc TLSH 5875B026795802B8D176C276C5C75802D7B278461372EBCF23806B6A2F1B7E99F3E711
Detection
PeID
.NET executableMASM/TASM - sig4 (h)Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 10 files
EXE1bb536a4baf42af61d08306cc89e93af
Structure
EXEOverlay_e3507916.bin
Structure
BINOverlay_32d34cd2.bin
BINResources
BINRT_MANIFEST
BINID:0001
BINID:1033
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINnFv7IBu1tu5UqGVvy0.1qqLIx5TQqMNDsZwKT
BINMapN1rav97RmZgniP9.4iOpS0KPskwmiHQ8oa
BINJncT5NHEj7KVXNreu0.eFDLu9T1Bb2GRpuBk9
BIN9lwcejvo3EsbUamvYm.IXhUNG0LndWv3S3RGa
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:exe>pe:rsrc>bin
Shape pe:exe>pe:exe>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:exe>bin
Shape pe:exe>pe:exe>bin
malicious 3 nodes

Name Value
Module Name
Bwdscehdgp.exe
Full Name
Bwdscehdgp.exe
EntryPoint
System.Void NNDXF4xu1Git8WqLrU.Ddn7gkdcSwuwHjw9kT::fHPeEE0Hw()
Scope Name
Bwdscehdgp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bwdscehdgp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NNDXF4xu1Git8WqLrU.Ddn7gkdcSwuwHjw9kT::fHPeEE0Hw()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0135: ret
ldsfld FJkuiTK7K6XJF0yepOu FJkuiTK7K6XJF0yepOu::QKkKCanhWV
call System.Void FJkuiTK7K6XJF0yepOu::GynKbxBiJV(FJkuiTK7K6XJF0yepOu)
ldc.i4 1
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_9dc3fc2686fc475f854edbbf21a069ab
brtrue IL_0014: switch(IL_0135,IL_0061,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0135,IL_0061,IL_0038)
nop <null>
newobj System.Void pNQxE43mdMVkaVysAu.SfXC0QWOB2gkWRC81i::.ctor()
ldsfld TqgNBRKVfZWKXctpYM5 TqgNBRKVfZWKXctpYM5::Wn5K2oTFkc
call System.Void TqgNBRKVfZWKXctpYM5::GynKbxBiJV(System.Object,TqgNBRKVfZWKXctpYM5)
ldc.i4 0
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_1a4a5a313c394f0e8eb765a99b4ecf02
brfalse IL_00A2: switch(IL_00BE)
pop <null>
ldc.i4 0
br IL_00A2: switch(IL_00BE)
br IL_009E: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_009E: ldloc V_2
br IL_00BE: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_7d88148b57bd4ea48d09c44dfa469bd7
brfalse IL_00F5: switch(IL_0111)
pop <null>
ldc.i4 0
br IL_00F5: switch(IL_0111)
br IL_00F1: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00F1: ldloc V_1
br IL_0111: leave IL_0135
leave IL_0135: ret
ldc.i4 5
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_65879aa4b93f47959e95443a0bf8b257
brtrue IL_0014: switch(IL_0135,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0135,IL_0061,IL_0038)
ret <null>
Info
Overlay extracted: Overlay_e3507916.bin (838675 bytes)
Module Name
Bwdscehdgp.exe
Full Name
Bwdscehdgp.exe
EntryPoint
System.Void NNDXF4xu1Git8WqLrU.Ddn7gkdcSwuwHjw9kT::fHPeEE0Hw()
Scope Name
Bwdscehdgp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bwdscehdgp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NNDXF4xu1Git8WqLrU.Ddn7gkdcSwuwHjw9kT::fHPeEE0Hw()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0135: ret
ldsfld FJkuiTK7K6XJF0yepOu FJkuiTK7K6XJF0yepOu::QKkKCanhWV
call System.Void FJkuiTK7K6XJF0yepOu::GynKbxBiJV(FJkuiTK7K6XJF0yepOu)
ldc.i4 1
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_9dc3fc2686fc475f854edbbf21a069ab
brtrue IL_0014: switch(IL_0135,IL_0061,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0135,IL_0061,IL_0038)
nop <null>
newobj System.Void pNQxE43mdMVkaVysAu.SfXC0QWOB2gkWRC81i::.ctor()
ldsfld TqgNBRKVfZWKXctpYM5 TqgNBRKVfZWKXctpYM5::Wn5K2oTFkc
call System.Void TqgNBRKVfZWKXctpYM5::GynKbxBiJV(System.Object,TqgNBRKVfZWKXctpYM5)
ldc.i4 0
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_1a4a5a313c394f0e8eb765a99b4ecf02
brfalse IL_00A2: switch(IL_00BE)
pop <null>
ldc.i4 0
br IL_00A2: switch(IL_00BE)
br IL_009E: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_009E: ldloc V_2
br IL_00BE: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_7d88148b57bd4ea48d09c44dfa469bd7
brfalse IL_00F5: switch(IL_0111)
pop <null>
ldc.i4 0
br IL_00F5: switch(IL_0111)
br IL_00F1: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00F1: ldloc V_1
br IL_0111: leave IL_0135
leave IL_0135: ret
ldc.i4 5
ldsfld <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f} <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_2251e30c7da641889995dc7c9a1a450e
ldfld System.Int32 <Module>{aed73f31-f24c-4055-9ac5-fc65175df54f}::m_65879aa4b93f47959e95443a0bf8b257
brtrue IL_0014: switch(IL_0135,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0135,IL_0061,IL_0038)
ret <null>

1 malicious · 10 files
EXE1bb536a4baf42af61d08306cc89e93af
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙