3ff1129f6b1a2480b60cf4002adb2506

PE Executable

MD5: 3ff1129f6b1a2480b60cf4002adb2506

Size: 1.2 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.2 MB · 1,200,640 B

First seen

2026-09-10 11:15 · one month ago

Last seen

2026-09-10 11:15 · one month ago

Last analysis

2026-09-10 11:16 · one month ago

Hashes

MD5 3ff1129f6b1a2480b60cf4002adb2506 Sha1 45822cd242fb4a53e2759715bd5089a81d162c02 Sha256 db08fc16b43a9d245aa7f1ba04123fd9cc321430601d44fb5b479f04cee8ec45 Sha384 7f0b440b9d5d76ebe2f9e0d25b0a5d857c38140130a40695d40187e9343dc01d8481882abe1090c7283913161f02d933 Sha512 974fab184343b91e5b65bf69c11bc2847c1a05ef484ee5c10766b63ab5800ac51017e457dc12e763fc55b4909eb556614f369b9fd6e8fdf8f1f1bcb144be1b2e SSDeep 24576:TTD1ojP/2oSdvOLRfA43XbnmTgcrmfoS3HsLQ:3yb/2oSMLR42rnGg TLSH 2345E0142116DC12E0E25AB1D8E0E2FF06745E87E522F6079AEA7D9F7536784FB842C3

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Medium

1 malicious · 19 files

EXE3ff1129f6b1a2480b60cf4002adb2506

Structure

BIN.Net Resources

BINy9.ae.resources

BINHAS.UAJ.resources

ICON$this.Icon

BIN[NBF]root.IconData

BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources

ICON$this.Icon

BIN[NBF]root.IconData

BINprogressBar1.Modifiers

BIN$this.Language

BIN$this.GridSize

BINHydroReservoir.Properties.Resources.resources

BINPro

DATA[NBF]root.Data

BINwazm

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	dwFF.exe
Full Name	dwFF.exe
EntryPoint	System.Void tv.Rx::uc()
Scope Name	dwFF.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	dwFF
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	395
Main Method	System.Void tv.Rx::uc()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> newobj System.Void y9.ae::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0021: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0023: call System.Void VGG.NGA::SOt() nop <null> ret <null> call System.Void VGG.NGA::SOt() br IL_0005: nop nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0015: nop`
Module Name	dwFF.exe
Full Name	dwFF.exe
EntryPoint	System.Void tv.Rx::uc()
Scope Name	dwFF.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	dwFF
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	395
Main Method	System.Void tv.Rx::uc()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> newobj System.Void y9.ae::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0021: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0023: call System.Void VGG.NGA::SOt() nop <null> ret <null> call System.Void VGG.NGA::SOt() br IL_0005: nop nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0015: nop`

1 malicious · 19 files

EXE3ff1129f6b1a2480b60cf4002adb2506

Structure

BIN.Net Resources

BINResources

No malware configuration was found at this point.