Suspect
PE Executable
MD5: 4d891a9e99ffdb0f77b8f2ed5aea684b
Size: 894.98 KB
application/x-dosexec
This sample is a 874 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 16 embedded or derived files. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 6f1d6b4b84c858c988e6a1d5515eafdb7095b0af7b2a85c606efbbe4df0d3b84
- MD5
- 4d891a9e99ffdb0f77b8f2ed5aea684b
- Verdict
- Inconclusive
- File type
- PE Executable · 874 KB
- MITRE ATT&CK
- T1059.007
Cite this report: https://app.malva.re/sha256/6f1d6b4b84c858c988e6a1d5515eafdb7095b0af7b2a85c606efbbe4df0d3b84
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
894.98 KB · 894,976 B
First seen
2026-09-27 12:15 · one month ago
Last seen
2026-09-27 12:15 · one month ago
Last analysis
2026-09-27 12:15 · one month ago
Hashes
MD5
4d891a9e99ffdb0f77b8f2ed5aea684b
Sha1
a5b381d894e053f2e3421d72325f14ed1c7d4982
Sha256
6f1d6b4b84c858c988e6a1d5515eafdb7095b0af7b2a85c606efbbe4df0d3b84
Sha384
ac5d1fe12b9f032f925e103f145acbb717eabf3d0a08b9d3b3a51d620e6271b79faec570de5ff9d3a54c9f3d63d6c308
Sha512
e86d9025a7d3652635ee7e5d9575a03fa5617af5837571b2dbbe793dc7abe890a0fee57f1043102c066e9fa8f46c7ce23e9ed9375f9abea669c1d18dfcaa7922
SSDeep
12288:TYEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fyO:TbJIJ4TiIaBYfTz9wC3pKqH8fyO
TLSH
EB15291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation
17 files
EXE4d891a9e99ffdb0f77b8f2ed5aea684bT1059.007
Structure
BINResources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:exe~T1059.007>pe:rsrc>bin
Shape
pe:exe>pe:rsrc>bin
technique3 nodes