Suspicious
Suspect

50f80b086aac1820defd105200518c2f

Share on LinkedIn
Print
PE Executable
MD5: 50f80b086aac1820defd105200518c2f
Size: 1.12 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 42 embedded or derived files. It matches 3 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4
MD5
50f80b086aac1820defd105200518c2f
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.12 MB · 1,120,768 B
First seen
2026-06-22 12:31 · 4 months ago
Last seen
2026-06-22 12:31 · 4 months ago
Last analysis
2026-06-22 12:34 · 4 months ago
Hashes
MD5 50f80b086aac1820defd105200518c2f Sha1 b66cd7c24d5867bc26ad615d33c0123fdc0c634a Sha256 99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4 Sha384 cf0fc7225b0d1eb1619d83bd8a7ace7c87525bcd701e792503b7e553707364a9c370bb2fcd739ab4fa0c9b22385b6044 Sha512 fdf7f4c590ecbd09be60bc29c2feec5b5bd85c74da01641f39b5986f02a32f83199c3b94226dcaf5f68ed27edd12bd5356dcd6dcfcac310d0b249fc36139c025 SSDeep 24576:xb2c6hIECGQ+H/JTL6CfpVobmRi/M9RTQ:xbPQiM/6CxqbmRh TLSH 683501251D463B48CA7E0FB8C122145873F0D89783A6D72A2FFD51F59EA3B84CC6B952
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Very high

43 files
EXE50f80b086aac1820defd105200518c2f
Structure

Name Value
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙