Suspicious
Suspect

31dac11d9a4cf2c46726ec9374148e1a

PE Executable
MD5: 31dac11d9a4cf2c46726ec9374148e1a
Size: 1.09 MB
application/x-dosexec

This sample is a 1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 58 embedded or derived files. It matches 8 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
8a75a4f18fa244786f536da897be4e25300f27c1f9f28e31f6e09c941a0899d0
MD5
31dac11d9a4cf2c46726ec9374148e1a
Verdict
Inconclusive
File type
PE Executable · 1 MB
MITRE ATT&CK
T1059.007

Cite this report: https://app.malva.re/sha256/8a75a4f18fa244786f536da897be4e25300f27c1f9f28e31f6e09c941a0899d0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.09 MB · 1,087,488 B
First seen
2026-09-10 14:30 · one month ago
Last seen
2026-09-10 14:30 · one month ago
Last analysis
2026-09-10 14:30 · one month ago
Hashes
MD5 31dac11d9a4cf2c46726ec9374148e1a Sha1 3c0b5b342bcb662abed9451760fc00b23a16678e Sha256 8a75a4f18fa244786f536da897be4e25300f27c1f9f28e31f6e09c941a0899d0 Sha384 2fdd32a0db5cac357df8a2f98c60142023ac023c0afd1d9a8933b07a588d660873c71f189e044bc47549fec42a129e0f Sha512 931b85e66e3c3f39f4aa6a626cb6c0d2a0a9fee28d844d3ede1815b80f734aa6da1495a8b2fe28069a940bd79aeafb7a56f0041e365e6e34f1dccca08657006c SSDeep 12288:71pI2Sx1Ti8Wc/VYhzjP2QNO66in2ABsTDJUdQJu3grkPZJF1+SeaKHaBMC:71pdYocNYtfO66i2FudGu3TJFUABM TLSH DD35DF1523D85F58F9BF97798935151107F7BD069F36E3EE2E8C2CD92A31A408A22723
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

59 files
EXE31dac11d9a4cf2c46726ec9374148e1a
Structure
BIN.Net Resources
BINfn0S5Atj.g.resources
BINfn0S5Atj.Resources.resources
BIN5613be6f65b182.Resources.resources
BIN9f9a179a0
DATA[NBF]root.Data
BIN9f9a179a1
DATA[NBF]root.Data
BIN9f9a179a10
DATA[NBF]root.Data
BIN9f9a179a11
DATA[NBF]root.Data
BIN9f9a179a12
DATA[NBF]root.Data
BIN9f9a179a13
DATA[NBF]root.Data
BIN9f9a179a14
DATA[NBF]root.Data
BIN9f9a179a15
DATA[NBF]root.Data
BIN9f9a179a16
DATA[NBF]root.Data
BIN9f9a179a17
DATA[NBF]root.Data
BIN9f9a179a18
DATA[NBF]root.Data
BIN9f9a179a19
DATA[NBF]root.Data
BIN9f9a179a2
DATA[NBF]root.Data
BIN9f9a179a20
DATA[NBF]root.Data
BIN9f9a179a21
DATA[NBF]root.Data
BIN9f9a179a22
DATA[NBF]root.Data
BIN9f9a179a23
DATA[NBF]root.Data
BIN9f9a179a24
DATA[NBF]root.Data
BIN9f9a179a25
DATA[NBF]root.Data
BIN9f9a179a3
DATA[NBF]root.Data
BIN9f9a179a4
DATA[NBF]root.Data
BIN9f9a179a5
DATA[NBF]root.Data
BIN9f9a179a6
DATA[NBF]root.Data
BIN9f9a179a7
DATA[NBF]root.Data
BIN9f9a179a8
DATA[NBF]root.Data
BIN9f9a179a9
DATA[NBF]root.Data
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
technique3 nodes
Path pe:exe~T1059.007>bin
Shape pe:exe>bin
technique2 nodes

Name Value
Module Name
fn0S5Atj
Full Name
fn0S5Atj
EntryPoint
System.Void fn0S5Atj.2nqSsZ0a::tAm18eTfxJ()
Scope Name
fn0S5Atj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fn0S5Atj
Assembly Version
19.1.47.101
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
783
Main Method
System.Void fn0S5Atj.2nqSsZ0a::tAm18eTfxJ()
Main IL Instruction Count
30
Main IL 
nop <null>
nop <null>
ldc.i4.s 25
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void fn0S5Atj.2nqSsZ0a::gMa4m3Ep6A(System.Object[],System.Int32)
nop <null>
leave.s IL_0037: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
ldloc.2 <null>
callvirt System.String System.Exception::ToString()
ldc.i4.0 <null>
ldnull <null>
call Microsoft.VisualBasic.MsgBoxResult Microsoft.VisualBasic.Interaction::MsgBox(System.Object,Microsoft.VisualBasic.MsgBoxStyle,System.Object)
pop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0037: nop
nop <null>
ret <null>
Module Name
fn0S5Atj
Full Name
fn0S5Atj
EntryPoint
System.Void fn0S5Atj.2nqSsZ0a::tAm18eTfxJ()
Scope Name
fn0S5Atj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fn0S5Atj
Assembly Version
19.1.47.101
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
783
Main Method
System.Void fn0S5Atj.2nqSsZ0a::tAm18eTfxJ()
Main IL Instruction Count
30
Main IL 
nop <null>
nop <null>
ldc.i4.s 25
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.1 <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void fn0S5Atj.2nqSsZ0a::gMa4m3Ep6A(System.Object[],System.Int32)
nop <null>
leave.s IL_0037: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
ldloc.2 <null>
callvirt System.String System.Exception::ToString()
ldc.i4.0 <null>
ldnull <null>
call Microsoft.VisualBasic.MsgBoxResult Microsoft.VisualBasic.Interaction::MsgBox(System.Object,Microsoft.VisualBasic.MsgBoxStyle,System.Object)
pop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0037: nop
nop <null>
ret <null>

59 files
EXE31dac11d9a4cf2c46726ec9374148e1a
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙