Suspicious
Suspect

247872a20ddb6f75bb2f80526dd22a63

Share on LinkedIn
Print
PE Executable
MD5: 247872a20ddb6f75bb2f80526dd22a63
Size: 5.27 MB
application/x-dosexec

This sample is a 5 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
eae060ec7b72faf302fc7a95504c2a12992521b413ea3d5a3fee1a7cedb699db
MD5
247872a20ddb6f75bb2f80526dd22a63
Verdict
Inconclusive
File type
PE Executable · 5 MB

Cite this report: https://app.malva.re/sha256/eae060ec7b72faf302fc7a95504c2a12992521b413ea3d5a3fee1a7cedb699db

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
5.27 MB · 5,267,459 B
First seen
2026-10-31 00:15 · yesterday
Last seen
2026-10-31 00:15 · yesterday
Last analysis
2026-10-31 00:15 · yesterday
Hashes
MD5 247872a20ddb6f75bb2f80526dd22a63 Sha1 f80c8b552410ca5419be36949cc2b3ed80e94870 Sha256 eae060ec7b72faf302fc7a95504c2a12992521b413ea3d5a3fee1a7cedb699db Sha384 64dc0790afce9996c5f9a9da15b8afed9b14625b9e127ffa5215b13007c06549a05ff1b586be144fd8fa7d234e356c83 Sha512 26d65702ac637ccfa130f7f3666a1a9bd1ad53df257ace05111453253141fec73c09c6387414b50cab93ab5d1c01aa81c0a254878a1196bf3fe7e8b2610d98ef SSDeep 49152:RnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1lqPoBhz1aRxcSUDk36SA TLSH 1536E115A1E86B64E7F36EB2217B871007797E45889B925E1760A04F0C33F5CDEE2F29
Detection
PeID
Microsoft Visual C++ 6.0Microsoft Visual C++ 6.0 DLLMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLMicrosoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

3 files
EXE247872a20ddb6f75bb2f80526dd22a63
BINOverlay_693e9af8.bin
EXE[Rebuild from dump]_947be6ff.exe
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:dll>pe:dll
Shape pe:dll>pe:dll
2 nodes

Name Value
Info
Overlay extracted: Overlay_693e9af8.bin (3 bytes)

PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙