Suspicious
Suspect

414b9be01f563e769d9be33d22e9fc52

PE Executable
MD5: 414b9be01f563e769d9be33d22e9fc52
Size: 197.12 KB
application/x-dosexec

This sample is a 192.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8
MD5
414b9be01f563e769d9be33d22e9fc52
Verdict
Inconclusive
File type
PE Executable · 192.5 KB

Cite this report: https://app.malva.re/sha256/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
197.12 KB · 197,120 B
First seen
2026-10-28 11:00 · 8 hours ago
Last seen
2026-10-28 11:00 · 8 hours ago
Last analysis
2026-10-28 11:00 · 8 hours ago
Hashes
MD5 414b9be01f563e769d9be33d22e9fc52 Sha1 5b6c234af55c80dee1a31a7d39e0bbfb0a086314 Sha256 abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8 Sha384 7c6a96590a34ca4cff9381f709f65900e28c09037856ff6f1503f8aae3dd7f677320321980135e9da694067fe11fa1a9 Sha512 60eaf5b0cb1116a57bdd912f0ca4bb4aa54abcd9a398748ea1acc2f016b1f4934e4895d384f55d9c38779276a247daae438d24f67bc127bbe3306f9e39170c7a SSDeep 3072:sqrR+9b/TMUsXtU4ZuZldSie6TEd2hoAa8OugMIsJc+KwYqenbFlLv5nNFTrWeTt:7ro1bMUQ4REYhoAbVIJ5ZbFZRNFWeT TLSH C41412B4A19FD1D3E676C638E5FE8C5217E70C29CADBA0361785F419F072AC708A3A54
Detection
PeID
x64 - UPX exe - NRV2E/7 compression UPX v3.95 -> dhondta

2 files
EXE414b9be01f563e769d9be33d22e9fc52
Structure
EXE[UPX unpacked Nrv2ELe32].exe
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe
Shape pe:exe
1 nodes

Name Value
UPX
UPX method: Nrv2ELe32, filter: X86CallJump
UPX 
UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored
UPX 
UPX anomaly: UPX declared original file size differs from reconstructed file (overlay or modified header)

2 files
EXE414b9be01f563e769d9be33d22e9fc52
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙