PE Executable file analysis – abc6d5128aeb

This sample is a 192.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256: abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8
MD5: 414b9be01f563e769d9be33d22e9fc52
Verdict: Inconclusive
File type: PE Executable · 192.5 KB

Cite this report: https://app.malva.re/sha256/abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

197.12 KB · 197,120 B

Hashes

MD5 414b9be01f563e769d9be33d22e9fc52 Sha1 5b6c234af55c80dee1a31a7d39e0bbfb0a086314 Sha256 abc6d5128aebe4cc8071cbba5e54d2bcdb57dfd116eec15b7b38858f2e66f5a8 Sha384 7c6a96590a34ca4cff9381f709f65900e28c09037856ff6f1503f8aae3dd7f677320321980135e9da694067fe11fa1a9 Sha512 60eaf5b0cb1116a57bdd912f0ca4bb4aa54abcd9a398748ea1acc2f016b1f4934e4895d384f55d9c38779276a247daae438d24f67bc127bbe3306f9e39170c7a SSDeep 3072:sqrR+9b/TMUsXtU4ZuZldSie6TEd2hoAa8OugMIsJc+KwYqenbFlLv5nNFTrWeTt:7ro1bMUQ4REYhoAbVIJ5ZbFZRNFWeT TLSH C41412B4A19FD1D3E676C638E5FE8C5217E70C29CADBA0361785F419F072AC708A3A54

Detection

PeID

x64 - UPX exe - NRV2E/7 compression UPX v3.95 -> dhondta

2 files

EXE414b9be01f563e769d9be33d22e9fc52

Structure

EXE[UPX unpacked Nrv2ELe32].exe

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe

Shape pe:exe

1 nodes

Name Value

UPX

Name	Value
UPX	UPX method: Nrv2ELe32, filter: X86CallJump
UPX	`UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored`
UPX	`UPX anomaly: UPX declared original file size differs from reconstructed file (overlay or modified header)`

UPX method: Nrv2ELe32, filter: X86CallJump

UPX

UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored

UPX

UPX anomaly: UPX declared original file size differs from reconstructed file (overlay or modified header)

414b9be01f563e769d9be33d22e9fc52

Overview

Summary by MalvaGPT

Characteristics

File Structure

Information3

414b9be01f563e769d9be33d22e9fc52 (197.12 KB)

File Structure