Malicious
Malicious

1c7972e98f5e371f0a9568a038d3c37d

PE Executable
MD5: 1c7972e98f5e371f0a9568a038d3c37d
Size: 840.7 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 821 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 4 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a706e51e945bc050debfb443130276bd71a9bf19ffaaa0615abf871f6fbb4e54
MD5
1c7972e98f5e371f0a9568a038d3c37d
Verdict
Malicious
File type
PE Executable · 821 KB

Cite this report: https://app.malva.re/sha256/a706e51e945bc050debfb443130276bd71a9bf19ffaaa0615abf871f6fbb4e54

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
840.7 KB · 840,704 B
First seen
2026-11-01 07:00 · 3 hours ago
Last seen
2026-11-01 07:00 · 3 hours ago
Last analysis
2026-11-01 07:00 · 3 hours ago
Hashes
MD5 1c7972e98f5e371f0a9568a038d3c37d Sha1 e7cc0cfaaad0e8924b1e4308208584dc8e81bc3b Sha256 a706e51e945bc050debfb443130276bd71a9bf19ffaaa0615abf871f6fbb4e54 Sha384 c8847dc3519de03dd9b3b262c036e757bcfc3c972107444adb2b25dbb162456542577380b86774ae18887795acb4971f Sha512 bde5008b604ab517f7c2508c78e19bf023fcf3dea101f40b475e96baa5a897fc48fa245037665084987e3fc39e659dc88c6f30a8be21dfca19c9b267eb94c8b2 SSDeep 24576:6N8PemtXBkTVvhQwAhn8J7RjZJakuRPaV:K+bXmTVvttTYRCV TLSH F705AE273A654E51C2E90773C0C7991083A39686FAF7E30FB24413661D4B3EEDA4B697
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Symbol obfuscation
Very high

1 malicious · 7 files
EXE1c7972e98f5e371f0a9568a038d3c37d
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINSyNZ2oYrbpnWZ66gwR.j2MHwGpO5itQZEj22h
BINCbpFLedN6YIGpar64F.k0k9sgliSpAAx0jJI8
BIN3Nfqp8yWBODmTsIOKW.KkrY6yaO3fuV1YULGy
BINIfroE2IKuvpvms07OZ.ANmukNSIeGDNtOYDyF
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Iebdkiyprl.exe
Full Name
Iebdkiyprl.exe
EntryPoint
System.Void tbyWn04Fn7TOyQpwHJ.bvK10yv6WF05n4XEJP::kFDixC6go()
Scope Name
Iebdkiyprl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Iebdkiyprl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tbyWn04Fn7TOyQpwHJ.bvK10yv6WF05n4XEJP::kFDixC6go()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0062: nop
ret <null>
ldsfld bGyl2avCOXYIEVOtZEo bGyl2avCOXYIEVOtZEo::JmWvfCwNcs
call System.Void bGyl2avCOXYIEVOtZEo::fsuv6MiSbD(bGyl2avCOXYIEVOtZEo)
ldc.i4 2
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_85e91c9149e74029a0b90bf586dfa752
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld AZqQx4v2lRkP36JTItT AZqQx4v2lRkP36JTItT::QFJvU49cSe
call System.Byte[] AZqQx4v2lRkP36JTItT::fsuv6MiSbD(AZqQx4v2lRkP36JTItT)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_479121ea4eda4a9b8977714401b987ea
brtrue IL_00A0: switch(IL_0136,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0136,IL_00C0)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 -1809441552
ldc.i4 -1809441552
ldc.i4 -1298391910
xor <null>
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_479121ea4eda4a9b8977714401b987ea
xor <null>
ldsfld u9ZU8bveJeUuOiEu8EH u9ZU8bveJeUuOiEu8EH::WxQvgWDeAl
call System.String u9ZU8bveJeUuOiEu8EH::fsuv6MiSbD(System.Int32,u9ZU8bveJeUuOiEu8EH)
ldc.i4 480700918
neg <null>
ldc.i4 -993454004
xor <null>
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_479633d7cf924e85bad8a3dcd6fd1482
xor <null>
ldsfld u9ZU8bveJeUuOiEu8EH u9ZU8bveJeUuOiEu8EH::WxQvgWDeAl
call System.String u9ZU8bveJeUuOiEu8EH::fsuv6MiSbD(System.Int32,u9ZU8bveJeUuOiEu8EH)
newobj System.Void uMv2iETyYhufI1IAOu.whrD1vusDmqsmeIBAl::.ctor(System.String,System.String)
newobj System.Void G03EqTSYJdSygHP7IHL.LdtCU4SlBIgRhd7lKuV::.ctor(uMv2iETyYhufI1IAOu.whrD1vusDmqsmeIBAl)
ldloc.s V_3
ldsfld xWIpKWvH93oZUxja9OK xWIpKWvH93oZUxja9OK::piVvzT9ed1
call System.Void xWIpKWvH93oZUxja9OK::fsuv6MiSbD(System.Object,System.Byte[],xWIpKWvH93oZUxja9OK)
ldc.i4 2
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_a6f981c9c61a4eb695530fa261419467
brtrue IL_00A0: switch(IL_0136,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0136,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 1
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_00d546e4091c4611982e1c992c417622
brtrue IL_016D: switch(IL_0189)
pop <null>
ldc.i4 0
br IL_016D: switch(IL_0189)
br IL_0169: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0169: ldloc V_1
br IL_0189: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{58472d8a-6297-4320-b8f7-123e675fbef1} <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_55d2562c928e4f3c86321fa66cf6ea4a
ldfld System.Int32 <Module>{58472d8a-6297-4320-b8f7-123e675fbef1}::m_0d6b6d86e40f4f4ebc8c2295dc5e3a2b
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0062,IL_0039,IL_0038)

1 malicious · 7 files
EXE1c7972e98f5e371f0a9568a038d3c37d
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙