Malicious
Malicious

37e71ffa292235784707e7063bb0d561

Share on LinkedIn
Print
PE Executable
MD5: 37e71ffa292235784707e7063bb0d561
Size: 570.88 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 557.5 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bcca48907156b96e3baee96b2bbbeb196ca885ceb2c5e818cc0811e6c8c86829
MD5
37e71ffa292235784707e7063bb0d561
Verdict
Malicious
File type
PE Executable · 557.5 KB

Cite this report: https://app.malva.re/sha256/bcca48907156b96e3baee96b2bbbeb196ca885ceb2c5e818cc0811e6c8c86829

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
570.88 KB · 570,880 B
First seen
2026-10-28 02:30 · yesterday
Last seen
2026-10-28 02:30 · yesterday
Last analysis
2026-10-28 02:30 · yesterday
Hashes
MD5 37e71ffa292235784707e7063bb0d561 Sha1 a03161698abaf26756f94e4a64d26b5ca944ade5 Sha256 bcca48907156b96e3baee96b2bbbeb196ca885ceb2c5e818cc0811e6c8c86829 Sha384 a51a6e36198107171266a7c3cd702ddbfe7e35848ec8c85c3d272873c3bb912542d81a4673802fde93e1928e8dae4e01 Sha512 0b9ebff73d01bb5484e61ec2e0efd55b2735740f34af03c59e59e33e8d867c9eb530b1ecc26861f838d52fada4fab9e1bd16bd8dd2cc23280fc90618a02ba9ce SSDeep 12288:KYb63sNiecXugrs+rj/5HbBg0zo0Ugmy9rybW:KYOsNcXu5+f/51g0E0UgVZ TLSH 45C46C2636664E50C2994F77C18BA50083E2AAC2FEE7F70F718403662D473EED947697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE37e71ffa292235784707e7063bb0d561
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Gmvciovq.exe
Full Name
Gmvciovq.exe
EntryPoint
System.Void rJMqg0F2sm381vAanR.TE7BmMEhCpkCEWNKGM::kUipyPxIQ()
Scope Name
Gmvciovq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gmvciovq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rJMqg0F2sm381vAanR.TE7BmMEhCpkCEWNKGM::kUipyPxIQ()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld byof37EabYrYbg59NeU byof37EabYrYbg59NeU::WmaEyxKna0
ldsfld byof37EabYrYbg59NeU byof37EabYrYbg59NeU::WmaEyxKna0
call System.Void byof37EabYrYbg59NeU::xbtE2hthYT(byof37EabYrYbg59NeU)
ldc.i4 1
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_d0e0196e4ae043c3ae685a3d40c5afdc
brtrue IL_0014: switch(IL_01B7,IL_0061,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0061,IL_0038)
nop <null>
ldsfld wHm8lWENkl4IoVLA1rS wHm8lWENkl4IoVLA1rS::mgUEVcpu3M
call System.Byte[] wHm8lWENkl4IoVLA1rS::xbtE2hthYT(wHm8lWENkl4IoVLA1rS)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_b1954a8c7a784b0da62f6ed17328d9e5
brtrue IL_009F: switch(IL_00BF,IL_0140)
pop <null>
ldc.i4 6
br IL_009F: switch(IL_00BF,IL_0140)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_00BF: ldc.i4 -1415232248
ldc.i4 -1415232248
ldc.i4 1
shr <null>
ldc.i4 -1643588637
xor <null>
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_aa7ddc0fbe26451a8ea724bdd1dfce4f
xor <null>
ldsfld Vsif2gEtWONOjdm4TKC Vsif2gEtWONOjdm4TKC::J2OEuJfSgS
call System.String Vsif2gEtWONOjdm4TKC::xbtE2hthYT(System.Int32,Vsif2gEtWONOjdm4TKC)
ldc.i4 1246230626
ldc.i4 5
shl <null>
ldc.i4 436837260
xor <null>
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_356166bd1fcd4bb19c5328346964ea98
xor <null>
ldsfld Vsif2gEtWONOjdm4TKC Vsif2gEtWONOjdm4TKC::J2OEuJfSgS
call System.String Vsif2gEtWONOjdm4TKC::xbtE2hthYT(System.Int32,Vsif2gEtWONOjdm4TKC)
newobj System.Void XdpXK9iRq0oPRjK5hR.FmaD9YjqW4I9MEFm3m::.ctor(System.String,System.String)
newobj System.Void hyUBsOdhQ1Wbkja8yB6.iPDofHdOPIDVwXdrKOc::.ctor(XdpXK9iRq0oPRjK5hR.FmaD9YjqW4I9MEFm3m)
ldloc.s V_2
ldsfld MEub6gEJ4OIwglptcoX MEub6gEJ4OIwglptcoX::QixEzLVTe2
call System.Void MEub6gEJ4OIwglptcoX::xbtE2hthYT(System.Object,System.Byte[],MEub6gEJ4OIwglptcoX)
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_4ab81132bd4e4223a54ca6d1e46765ad
brfalse IL_009F: switch(IL_00BF,IL_0140)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_00BF,IL_0140)
leave IL_01B7: ret
pop <null>
ldc.i4 4
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_98ae2b0f8f2a457395c8309208a77ee6
brtrue IL_0177: switch(IL_0193)
pop <null>
ldc.i4 0
br IL_0177: switch(IL_0193)
br IL_0173: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0173: ldloc V_3
br IL_0193: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_12b03d36f61b4eee9b7b48d68b8a92ce
brtrue IL_0014: switch(IL_01B7,IL_0061,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_01B7,IL_0061,IL_0038)
ret <null>
Module Name
Gmvciovq.exe
Full Name
Gmvciovq.exe
EntryPoint
System.Void rJMqg0F2sm381vAanR.TE7BmMEhCpkCEWNKGM::kUipyPxIQ()
Scope Name
Gmvciovq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gmvciovq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rJMqg0F2sm381vAanR.TE7BmMEhCpkCEWNKGM::kUipyPxIQ()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld byof37EabYrYbg59NeU byof37EabYrYbg59NeU::WmaEyxKna0
ldsfld byof37EabYrYbg59NeU byof37EabYrYbg59NeU::WmaEyxKna0
call System.Void byof37EabYrYbg59NeU::xbtE2hthYT(byof37EabYrYbg59NeU)
ldc.i4 1
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_d0e0196e4ae043c3ae685a3d40c5afdc
brtrue IL_0014: switch(IL_01B7,IL_0061,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0061,IL_0038)
nop <null>
ldsfld wHm8lWENkl4IoVLA1rS wHm8lWENkl4IoVLA1rS::mgUEVcpu3M
call System.Byte[] wHm8lWENkl4IoVLA1rS::xbtE2hthYT(wHm8lWENkl4IoVLA1rS)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_b1954a8c7a784b0da62f6ed17328d9e5
brtrue IL_009F: switch(IL_00BF,IL_0140)
pop <null>
ldc.i4 6
br IL_009F: switch(IL_00BF,IL_0140)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_00BF: ldc.i4 -1415232248
ldc.i4 -1415232248
ldc.i4 1
shr <null>
ldc.i4 -1643588637
xor <null>
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_aa7ddc0fbe26451a8ea724bdd1dfce4f
xor <null>
ldsfld Vsif2gEtWONOjdm4TKC Vsif2gEtWONOjdm4TKC::J2OEuJfSgS
call System.String Vsif2gEtWONOjdm4TKC::xbtE2hthYT(System.Int32,Vsif2gEtWONOjdm4TKC)
ldc.i4 1246230626
ldc.i4 5
shl <null>
ldc.i4 436837260
xor <null>
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_356166bd1fcd4bb19c5328346964ea98
xor <null>
ldsfld Vsif2gEtWONOjdm4TKC Vsif2gEtWONOjdm4TKC::J2OEuJfSgS
call System.String Vsif2gEtWONOjdm4TKC::xbtE2hthYT(System.Int32,Vsif2gEtWONOjdm4TKC)
newobj System.Void XdpXK9iRq0oPRjK5hR.FmaD9YjqW4I9MEFm3m::.ctor(System.String,System.String)
newobj System.Void hyUBsOdhQ1Wbkja8yB6.iPDofHdOPIDVwXdrKOc::.ctor(XdpXK9iRq0oPRjK5hR.FmaD9YjqW4I9MEFm3m)
ldloc.s V_2
ldsfld MEub6gEJ4OIwglptcoX MEub6gEJ4OIwglptcoX::QixEzLVTe2
call System.Void MEub6gEJ4OIwglptcoX::xbtE2hthYT(System.Object,System.Byte[],MEub6gEJ4OIwglptcoX)
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_4ab81132bd4e4223a54ca6d1e46765ad
brfalse IL_009F: switch(IL_00BF,IL_0140)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_00BF,IL_0140)
leave IL_01B7: ret
pop <null>
ldc.i4 4
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_98ae2b0f8f2a457395c8309208a77ee6
brtrue IL_0177: switch(IL_0193)
pop <null>
ldc.i4 0
br IL_0177: switch(IL_0193)
br IL_0173: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0173: ldloc V_3
br IL_0193: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8} <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_3627ece7dea642878a25f22632ff4634
ldfld System.Int32 <Module>{a3683ce3-4630-41f3-b49a-fffe53854bf8}::m_12b03d36f61b4eee9b7b48d68b8a92ce
brtrue IL_0014: switch(IL_01B7,IL_0061,IL_0038)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_01B7,IL_0061,IL_0038)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙