Suspicious
Suspect

3eb1645f0ae2b0ef553ed6965bdef650

Disk Image
MD5: 3eb1645f0ae2b0ef553ed6965bdef650
Size: 1.86 MB

This sample is a 1.8 MB Disk Image for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 29 embedded or derived files. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d30801376fd1d33ae278925362db0c2b5094458578fbb60666daa6ae435f2f5c
MD5
3eb1645f0ae2b0ef553ed6965bdef650
Verdict
Inconclusive
File type
Disk Image · 1.8 MB

Cite this report: https://app.malva.re/sha256/d30801376fd1d33ae278925362db0c2b5094458578fbb60666daa6ae435f2f5c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Disk image
Size
1.86 MB · 1,855,488 B
First seen
2026-10-21 05:45 · 7 days ago
Last seen
2026-10-21 05:45 · 7 days ago
Last analysis
2026-10-21 05:45 · 7 days ago
Hashes
MD5 3eb1645f0ae2b0ef553ed6965bdef650 Sha1 d36823b248f71eed80ed1c25581bea917ea3dc07 Sha256 d30801376fd1d33ae278925362db0c2b5094458578fbb60666daa6ae435f2f5c Sha384 5e4b7c61f6580c91299c6c6219256af99465b8d22e8be38a9864118957cf1d2a15406f95d82d0c605e8ab274fad2082c Sha512 4f64bf151888600299fc5ec6a9bbd694fb358d4a48683d9e2eba76b68ee6d0979b838e7fde406e3a46e100cd1fe25ebfe2c04c69b8cdbc38e52e92f6dccde3e3 SSDeep 49152:4y5ori9fMbeVTXCLiaXKtR1x5zvNkB2MiGB:D/GqxXCLiftR1e2MiG TLSH 9385AE61F78644B5D4B3227121ADAB224A7EFCB40770D6C393C4B64EEF756D28A33612

30 files
ISO3eb1645f0ae2b0ef553ed6965bdef650
7Z7z-stream @ 0x000F05F8.7z
7ZZoomInstaller.exe
Structure
P7B[Authenticode]_75a76beb.p7b
BINResources
BINRT_BITMAP
BINID:00D2
BINID:1033
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
EXIFID:1033.exif
IMGID:1033-preview.png
BINRT_DIALOG
BINID:00CD
BINID:1033
BINRT_STRING
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:000E
BINID:1033
BINRT_GROUP_CURSOR4
BINID:00C9
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
7Z7z-stream @ 0x0008A5F8.7z
DLLmsvcp140.dll
Structure
P7B[Authenticode]_df899baa.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLoleacc.dll
Structure
BINOverlay_975ddf13.bin
BIN(folder)
BIN4
DLLvcruntime140.dll
Structure
P7B[Authenticode]_971dcb6d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
bin 4img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path img:disk>pe:exe>arc:7z
Shape img:disk>pe:exe>arc:7z
3 nodes
Path img:disk>arc:7zsfx
Shape img:disk>arc:7zsfx
2 nodes

30 files
ISO3eb1645f0ae2b0ef553ed6965bdef650
7Z7z-stream @ 0x000F05F8.7z
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙