Suspicious
Suspect

371e9978fe623a9ce1ce796a9c530db7

Share on LinkedIn
Print
PE Executable
MD5: 371e9978fe623a9ce1ce796a9c530db7
Size: 560.13 KB
application/x-dosexec

This sample is a 547 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
e702881e545e69338b7b9c7934b8a950d5aea71dec005e4a359bce0dd1422452
MD5
371e9978fe623a9ce1ce796a9c530db7
Verdict
Inconclusive
File type
PE Executable · 547 KB

Cite this report: https://app.malva.re/sha256/e702881e545e69338b7b9c7934b8a950d5aea71dec005e4a359bce0dd1422452

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
560.13 KB · 560,128 B
First seen
2026-10-29 06:45 · yesterday
Last seen
2026-10-29 06:45 · yesterday
Last analysis
2026-10-29 08:00 · yesterday
Hashes
MD5 371e9978fe623a9ce1ce796a9c530db7 Sha1 5d1cb80de2a6777b734e47337ec09260fa00993c Sha256 e702881e545e69338b7b9c7934b8a950d5aea71dec005e4a359bce0dd1422452 Sha384 68e95e29173f19a846d2405f02c4cb366baa41581cc3376919db72b042d8a4c6566c25bffb58049855bbf4294b8bd9ca Sha512 9b1bddd391dea1b2d725e15e661661e9e619f50e78ca9c6acdb5d9b24afbe0b1413dca43096ab440f49435f2c2f3794bf88c70bcb7eb1cb4dd78a4dfec85ffb4 SSDeep 12288:0a66uqitPlZSATMShO68J8oNaISL+al0gucxRRogmEM42gKdg44Jp9Dl:SlZSATMShOZn0I++a4cxRRXmi2gKdgp9 TLSH A0C4DF1811774B26D4B66FF46DB1E0B46BBA6D9A6171C1288FC22CDBB973B007D06723
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

9 files
EXE371e9978fe623a9ce1ce796a9c530db7
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
wiZu.exe
Full Name
wiZu.exe
EntryPoint
System.Void HillGather.Program::Main()
Scope Name
wiZu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
wiZu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
562
Main Method
System.Void HillGather.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void HillGather.HillForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
wiZu.exe
Full Name
wiZu.exe
EntryPoint
System.Void HillGather.Program::Main()
Scope Name
wiZu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
wiZu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
562
Main Method
System.Void HillGather.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void HillGather.HillForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙