Malicious PE Executable analysis – e9ae2f17b292

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

856.58 KB · 856,576 B

First seen

2026-10-14 11:30 · 11 days ago

Last seen

2026-10-14 11:30 · 11 days ago

Last analysis

2026-10-14 11:30 · 11 days ago

Hashes

MD5 213e1e5fb9665f6af3bbbe03486fcb02 Sha1 eecece9d5970ca2fc441ce80b2d5ec8718712d51 Sha256 e9ae2f17b2926e49768e787b1802282a32625244746713c32c7d6d32c225cf0e Sha384 fb7e2441e6d9dc3784663499a8f45ea8f29e32991286f6f5065c4178de445293bb0c4999283eee88c2e336ddb3bc2b77 Sha512 9a578abdd519fd5db9dccd4638eb97a778def84e4f9838eec216b71af5de3121e7c11d6f2884a0aba966d6ea2e7b31e868d4a0bab014c1b4f973264d741453f8 SSDeep 12288:fr0SmBQX+0TbUF8gTPAtjdLHPOq+CR6YiicKMlTdC+gT/4FN+obRvzZmft4AYz/2:zlbO8gsthHv6Yii6lOdgv0I/GV TLSH D305AB44665ADC12C5E946B1C8E1A1FF03B15D87E452F28B5AD53DAF3A36391FB802C3

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Medium

1 malicious · 19 files

EXE213e1e5fb9665f6af3bbbe03486fcb02

Structure

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	bmVh.exe
Full Name	bmVh.exe
EntryPoint	System.Void Qd.kZ::Fa()
Scope Name	bmVh.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	bmVh
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	432
Main Method	System.Void Qd.kZ::Fa()
Main IL Instruction Count	43
Main IL	br IL_0017: nop ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0050: call System.Void X01.s07::mNy() nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0085: nop ldsfld bgR.BgC Qd.kZ::l4 call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0078: nop nop <null> newobj System.Void RQo.KQV::.ctor() stsfld RQo.KQV Qd.kZ::dS br IL_0041: newobj System.Void O8x.u8F::.ctor() newobj System.Void O8x.u8F::.ctor() stsfld O8x.u8F Qd.kZ::bp br IL_00AB: newobj System.Void T8h.H8w::.ctor() call System.Void X01.s07::mNy() br IL_007A: nop newobj System.Void EtK.ut6::.ctor() stsfld EtK.ut6 Qd.kZ::bB br IL_0069: newobj System.Void bgR.BgC::.ctor() newobj System.Void bgR.BgC::.ctor() stsfld bgR.BgC Qd.kZ::l4 br IL_0022: ldsfld bgR.BgC Qd.kZ::l4 nop <null> ret <null> nop <null> call System.Void Qd.kZ::bT() br IL_0031: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 0 ldsfld <Module>{2fa2d1c6-0f39-40b3-a0c1-0755fb575893} <Module>{2fa2d1c6-0f39-40b3-a0c1-0755fb575893}::m_f501d590df83400397998bfcd356fcb4 ldfld System.Int32 <Module>{2fa2d1c6-0f39-40b3-a0c1-0755fb575893}::m_87865d7724fd4f3aa6d93be012854a7b brfalse IL_0009: switch(IL_0050) pop <null> ldc.i4 0 br IL_0009: switch(IL_0050) newobj System.Void T8h.H8w::.ctor() stsfld T8h.H8w Qd.kZ::hy br IL_005A: newobj System.Void EtK.ut6::.ctor()