Malicious
517b77d282d81a15a17f83759108d7ea
Rar Archive
MD5: 517b77d282d81a15a17f83759108d7ea
Size: 3.59 MB
application/vnd.rar
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB Rar Archive identified by Malva.RE as .NET Reflective Loader (loader, crypter). Static analysis extracted 583 embedded or derived files. It matches 18 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
- MD5
- 517b77d282d81a15a17f83759108d7ea
- Verdict
- Malicious
- File type
- Rar Archive · 3.4 MB
- Family
- .NET Reflective Loader
- Category
- Loader, Crypter
- MITRE ATT&CK
- T1059.007
Cite this report: https://app.malva.re/sha256/e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
Related .NET Reflective Loader samples
- 847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091 2026-10-28
- d6055b5594b16f82fce35db1a693e65fcf6209facbd90f755815e0e7b7791e7f 2026-10-19
- 86dfa03616288994385a6aaf1106e1320d92096122b376f2ef6229c73fc1ee0d 2026-10-14
- 08954f9446234a2fafe12537884cfd684df960b6d28527f6777248518ab7e526 2026-10-09
- 08edc0df73427e600402e4f2529d5284b17ccb16f4c24594869ca7e6ddc33936 2026-09-28
- 080dfb9d893d2dd995e8fb81a4098a8d908c563e38d70a8e5bc15debcf1f065a 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Rar archive
Size
3.59 MB · 3,590,520 B
First seen
2026-10-28 11:00 · 4 days ago
Last seen
2026-10-28 11:00 · 4 days ago
Last analysis
2026-10-28 11:01 · 4 days ago
Hashes
MD5
517b77d282d81a15a17f83759108d7ea
Sha1
b1a045508d07c94b03a35a81e68e98966e5d3b1d
Sha256
e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
Sha384
386004754987b67a6e3d64708c945b6b0495762b85ac7ccda41fb72bb2cfd2c9bc1ab6fa64e0e26b1e2d1efda33af96d
Sha512
9d18961134456a7e71056b65dc2ac1eee259277e7291b7fb71eb66cd1cbd43d21746cb5f33c1c69ec628155a98974b5c536f8748f85cba7350280eca18bbcf01
SSDeep
98304:AoO7pwcCAZGiY3u41ETf3xJ2WX1hv9atquy1gEV:Anm2GiYeHTf3xJFX/YtqbgEV
TLSH
CDF5335EE9CD75BF09C137C67E1829AB74DDBD84848278C096C24A486E1BF1A24FF81D
3 malicious · 584 files
RAR517b77d282d81a15a17f83759108d7eaT1059.007.NET Reflective Loader
EXEDahnay Presentation (3)-compressed.exeT1059.007.NET Reflective Loader
Structure
BIN.Net Resources
TSXMaselatki.562567.tsx
BIN6Rj_Ct3e4Jg.Resources.resources
BINd1eae1600f6dfc.Resources.resources
BIN8cfeb2f70
DATA[NBF]root.Data
BIN8cfeb2f71
DATA[NBF]root.Data
BIN8cfeb2f710
DATA[NBF]root.Data
BIN8cfeb2f7100
DATA[NBF]root.Data
BIN8cfeb2f7101
DATA[NBF]root.Data
BIN8cfeb2f7102
DATA[NBF]root.Data
BIN8cfeb2f7103
DATA[NBF]root.Data
BIN8cfeb2f7104
DATA[NBF]root.Data
BIN8cfeb2f7105
DATA[NBF]root.Data
BIN8cfeb2f7106
DATA[NBF]root.Data
BIN8cfeb2f7107
DATA[NBF]root.Data
BIN8cfeb2f7108
DATA[NBF]root.Data
BIN8cfeb2f7109
DATA[NBF]root.Data
BIN8cfeb2f711
DATA[NBF]root.Data
BIN8cfeb2f7110
DATA[NBF]root.Data
BIN8cfeb2f7111
DATA[NBF]root.Data
BIN8cfeb2f7112
DATA[NBF]root.Data
BIN8cfeb2f7113
DATA[NBF]root.Data
BIN8cfeb2f7114
DATA[NBF]root.Data
BIN8cfeb2f7115
DATA[NBF]root.Data
BIN8cfeb2f7116
DATA[NBF]root.Data
BIN8cfeb2f7117
DATA[NBF]root.Data
BIN8cfeb2f7118
DATA[NBF]root.Data
BIN8cfeb2f7119
DATA[NBF]root.Data
BIN8cfeb2f712
DATA[NBF]root.Data
BIN8cfeb2f7120
DATA[NBF]root.Data
BIN8cfeb2f7121
DATA[NBF]root.Data
BIN8cfeb2f7122
DATA[NBF]root.Data
BIN8cfeb2f7123
DATA[NBF]root.Data
BIN8cfeb2f7124
DATA[NBF]root.Data
BIN8cfeb2f7125
DATA[NBF]root.Data
BIN8cfeb2f7126
DATA[NBF]root.Data
BIN8cfeb2f7127
DATA[NBF]root.Data
BIN8cfeb2f7128
DATA[NBF]root.Data
BIN8cfeb2f7129
DATA[NBF]root.Data
BIN8cfeb2f713
DATA[NBF]root.Data
BIN8cfeb2f7130
DATA[NBF]root.Data
BIN8cfeb2f7131
DATA[NBF]root.Data
BIN8cfeb2f7132
DATA[NBF]root.Data
BIN8cfeb2f7133
DATA[NBF]root.Data
BIN8cfeb2f7134
DATA[NBF]root.Data
BIN8cfeb2f7135
DATA[NBF]root.Data
BIN8cfeb2f7136
DATA[NBF]root.Data
BIN8cfeb2f7137
DATA[NBF]root.Data
BIN8cfeb2f7138
DATA[NBF]root.Data
BIN8cfeb2f7139
DATA[NBF]root.Data
BIN8cfeb2f714
DATA[NBF]root.Data
BIN8cfeb2f7140
DATA[NBF]root.Data
BIN8cfeb2f7141
DATA[NBF]root.Data
BIN8cfeb2f7142
DATA[NBF]root.Data
BIN8cfeb2f7143
DATA[NBF]root.Data
BIN8cfeb2f7144
DATA[NBF]root.Data
BIN8cfeb2f7145
DATA[NBF]root.Data
BIN8cfeb2f7146
DATA[NBF]root.Data
BIN8cfeb2f7147
DATA[NBF]root.Data
BIN8cfeb2f7148
DATA[NBF]root.Data
BIN8cfeb2f7149
DATA[NBF]root.Data
BIN8cfeb2f715
DATA[NBF]root.Data
BIN8cfeb2f7150
DATA[NBF]root.Data
BIN8cfeb2f7151
DATA[NBF]root.Data
BIN8cfeb2f7152
DATA[NBF]root.Data
BIN8cfeb2f7153
DATA[NBF]root.Data
BIN8cfeb2f7154
DATA[NBF]root.Data
BIN8cfeb2f7155
DATA[NBF]root.Data
BIN8cfeb2f7156
DATA[NBF]root.Data
BIN8cfeb2f7157
DATA[NBF]root.Data
BIN8cfeb2f7158
DATA[NBF]root.Data
BIN8cfeb2f7159
DATA[NBF]root.Data
BIN8cfeb2f716
DATA[NBF]root.Data
BIN8cfeb2f7160
DATA[NBF]root.Data
BIN8cfeb2f7161
DATA[NBF]root.Data
BIN8cfeb2f7162
DATA[NBF]root.Data
BIN8cfeb2f7163
DATA[NBF]root.Data
BIN8cfeb2f7164
DATA[NBF]root.Data
BIN8cfeb2f7165
DATA[NBF]root.Data
BIN8cfeb2f7166
DATA[NBF]root.Data
BIN8cfeb2f7167
DATA[NBF]root.Data
BIN8cfeb2f7168
DATA[NBF]root.Data
BIN8cfeb2f7169
DATA[NBF]root.Data
BIN8cfeb2f717
DATA[NBF]root.Data
BIN8cfeb2f7170
DATA[NBF]root.Data
BIN8cfeb2f7171
DATA[NBF]root.Data
BIN8cfeb2f7172
DATA[NBF]root.Data
BIN8cfeb2f7173
DATA[NBF]root.Data
BIN8cfeb2f7174
DATA[NBF]root.Data
BIN8cfeb2f7175
DATA[NBF]root.Data
BIN8cfeb2f7176
DATA[NBF]root.Data
BIN8cfeb2f7177
DATA[NBF]root.Data
BIN8cfeb2f7178
DATA[NBF]root.Data
BIN8cfeb2f7179
DATA[NBF]root.Data
BIN8cfeb2f718
DATA[NBF]root.Data
BIN8cfeb2f7180
DATA[NBF]root.Data
BIN8cfeb2f7181
DATA[NBF]root.Data
BIN8cfeb2f7182
DATA[NBF]root.Data
BIN8cfeb2f7183
DATA[NBF]root.Data
BIN8cfeb2f7184
DATA[NBF]root.Data
BIN8cfeb2f7185
DATA[NBF]root.Data
BIN8cfeb2f7186
DATA[NBF]root.Data
BIN8cfeb2f7187
DATA[NBF]root.Data
BIN8cfeb2f7188
DATA[NBF]root.Data
BIN8cfeb2f7189
DATA[NBF]root.Data
BIN8cfeb2f719
DATA[NBF]root.Data
BIN8cfeb2f7190
DATA[NBF]root.Data
BIN8cfeb2f7191
DATA[NBF]root.Data
BIN8cfeb2f7192
DATA[NBF]root.Data
BIN8cfeb2f7193
DATA[NBF]root.Data
BIN8cfeb2f7194
DATA[NBF]root.Data
BIN8cfeb2f7195
DATA[NBF]root.Data
BIN8cfeb2f7196
DATA[NBF]root.Data
BIN8cfeb2f7197
DATA[NBF]root.Data
BIN8cfeb2f7198
DATA[NBF]root.Data
BIN8cfeb2f7199
DATA[NBF]root.Data
BIN8cfeb2f72
DATA[NBF]root.Data
BIN8cfeb2f720
DATA[NBF]root.Data
BIN8cfeb2f7200
DATA[NBF]root.Data
BIN8cfeb2f7201
DATA[NBF]root.Data
BIN8cfeb2f7202
DATA[NBF]root.Data
BIN8cfeb2f7203
DATA[NBF]root.Data
BIN8cfeb2f7204
DATA[NBF]root.Data
BIN8cfeb2f7205
DATA[NBF]root.Data
BIN8cfeb2f7206
DATA[NBF]root.Data
BIN8cfeb2f7207
DATA[NBF]root.Data
BIN8cfeb2f7208
DATA[NBF]root.Data
BIN8cfeb2f7209
DATA[NBF]root.Data
BIN8cfeb2f721
DATA[NBF]root.Data
BIN8cfeb2f7210
DATA[NBF]root.Data
BIN8cfeb2f7211
DATA[NBF]root.Data
BIN8cfeb2f7212
DATA[NBF]root.Data
BIN8cfeb2f7213
DATA[NBF]root.Data
BIN8cfeb2f7214
DATA[NBF]root.Data
BIN8cfeb2f7215
DATA[NBF]root.Data
BIN8cfeb2f7216
DATA[NBF]root.Data
BIN8cfeb2f7217
DATA[NBF]root.Data
BIN8cfeb2f7218
DATA[NBF]root.Data
BIN8cfeb2f7219
DATA[NBF]root.Data
BIN8cfeb2f722
DATA[NBF]root.Data
BIN8cfeb2f7220
DATA[NBF]root.Data
BIN8cfeb2f7221
DATA[NBF]root.Data
BIN8cfeb2f7222
DATA[NBF]root.Data
BIN8cfeb2f7223
DATA[NBF]root.Data
BIN8cfeb2f7224
DATA[NBF]root.Data
BIN8cfeb2f7225
DATA[NBF]root.Data
BIN8cfeb2f7226
DATA[NBF]root.Data
BIN8cfeb2f7227
DATA[NBF]root.Data
BIN8cfeb2f7228
DATA[NBF]root.Data
BIN8cfeb2f7229
DATA[NBF]root.Data
BIN8cfeb2f723
DATA[NBF]root.Data
BIN8cfeb2f7230
DATA[NBF]root.Data
BIN8cfeb2f7231
DATA[NBF]root.Data
BIN8cfeb2f7232
DATA[NBF]root.Data
BIN8cfeb2f7233
DATA[NBF]root.Data
BIN8cfeb2f7234
DATA[NBF]root.Data
BIN8cfeb2f7235
DATA[NBF]root.Data
BIN8cfeb2f7236
DATA[NBF]root.Data
BIN8cfeb2f7237
DATA[NBF]root.Data
BIN8cfeb2f7238
DATA[NBF]root.Data
BIN8cfeb2f7239
DATA[NBF]root.Data
BIN8cfeb2f724
DATA[NBF]root.Data
BIN8cfeb2f7240
DATA[NBF]root.Data
BIN8cfeb2f7241
DATA[NBF]root.Data
BIN8cfeb2f7242
DATA[NBF]root.Data
BIN8cfeb2f7243
DATA[NBF]root.Data
BIN8cfeb2f7244
DATA[NBF]root.Data
BIN8cfeb2f7245
DATA[NBF]root.Data
BIN8cfeb2f7246
DATA[NBF]root.Data
BIN8cfeb2f7247
DATA[NBF]root.Data
BIN8cfeb2f7248
DATA[NBF]root.Data
BIN8cfeb2f7249
DATA[NBF]root.Data
BIN8cfeb2f725
DATA[NBF]root.Data
BIN8cfeb2f7250
DATA[NBF]root.Data
BIN8cfeb2f7251
DATA[NBF]root.Data
BIN8cfeb2f7252
DATA[NBF]root.Data
BIN8cfeb2f7253
DATA[NBF]root.Data
BIN8cfeb2f7254
DATA[NBF]root.Data
BIN8cfeb2f7255
DATA[NBF]root.Data
BIN8cfeb2f7256
DATA[NBF]root.Data
BIN8cfeb2f7257
DATA[NBF]root.Data
BIN8cfeb2f7258
DATA[NBF]root.Data
BIN8cfeb2f7259
DATA[NBF]root.Data
BIN8cfeb2f726
DATA[NBF]root.Data
BIN8cfeb2f7260
DATA[NBF]root.Data
BIN8cfeb2f7261
DATA[NBF]root.Data
BIN8cfeb2f7262
DATA[NBF]root.Data
BIN8cfeb2f7263
DATA[NBF]root.Data
BIN8cfeb2f7264
DATA[NBF]root.Data
BIN8cfeb2f7265
DATA[NBF]root.Data
BIN8cfeb2f7266
DATA[NBF]root.Data
BIN8cfeb2f7267
DATA[NBF]root.Data
BIN8cfeb2f7268
DATA[NBF]root.Data
BIN8cfeb2f7269
DATA[NBF]root.Data
BIN8cfeb2f727
DATA[NBF]root.Data
BIN8cfeb2f7270
DATA[NBF]root.Data
BIN8cfeb2f7271
DATA[NBF]root.Data
BIN8cfeb2f7272
DATA[NBF]root.Data
BIN8cfeb2f7273
DATA[NBF]root.Data
BIN8cfeb2f7274
DATA[NBF]root.Data
BIN8cfeb2f7275
DATA[NBF]root.Data
BIN8cfeb2f7276
DATA[NBF]root.Data
BIN8cfeb2f7277
DATA[NBF]root.Data
BIN8cfeb2f7278
DATA[NBF]root.Data
BIN8cfeb2f7279
DATA[NBF]root.Data
BIN8cfeb2f728
DATA[NBF]root.Data
BIN8cfeb2f7280
DATA[NBF]root.Data
BIN8cfeb2f7281
DATA[NBF]root.Data
BIN8cfeb2f7282
DATA[NBF]root.Data
BIN8cfeb2f729
DATA[NBF]root.Data
BIN8cfeb2f73
DATA[NBF]root.Data
BIN8cfeb2f730
DATA[NBF]root.Data
BIN8cfeb2f731
DATA[NBF]root.Data
BIN8cfeb2f732
DATA[NBF]root.Data
BIN8cfeb2f733
DATA[NBF]root.Data
BIN8cfeb2f734
DATA[NBF]root.Data
BIN8cfeb2f735
DATA[NBF]root.Data
BIN8cfeb2f736
DATA[NBF]root.Data
BIN8cfeb2f737
DATA[NBF]root.Data
BIN8cfeb2f738
DATA[NBF]root.Data
BIN8cfeb2f739
DATA[NBF]root.Data
BIN8cfeb2f74
DATA[NBF]root.Data
BIN8cfeb2f740
DATA[NBF]root.Data
BIN8cfeb2f741
DATA[NBF]root.Data
BIN8cfeb2f742
DATA[NBF]root.Data
BIN8cfeb2f743
DATA[NBF]root.Data
BIN8cfeb2f744
DATA[NBF]root.Data
BIN8cfeb2f745
DATA[NBF]root.Data
BIN8cfeb2f746
DATA[NBF]root.Data
BIN8cfeb2f747
DATA[NBF]root.Data
BIN8cfeb2f748
DATA[NBF]root.Data
BIN8cfeb2f749
DATA[NBF]root.Data
BIN8cfeb2f75
DATA[NBF]root.Data
BIN8cfeb2f750
DATA[NBF]root.Data
BIN8cfeb2f751
DATA[NBF]root.Data
BIN8cfeb2f752
DATA[NBF]root.Data
BIN8cfeb2f753
DATA[NBF]root.Data
BIN8cfeb2f754
DATA[NBF]root.Data
BIN8cfeb2f755
DATA[NBF]root.Data
BIN8cfeb2f756
DATA[NBF]root.Data
BIN8cfeb2f757
DATA[NBF]root.Data
BIN8cfeb2f758
DATA[NBF]root.Data
BIN8cfeb2f759
DATA[NBF]root.Data
BIN8cfeb2f76
DATA[NBF]root.Data
BIN8cfeb2f760
DATA[NBF]root.Data
BIN8cfeb2f761
DATA[NBF]root.Data
BIN8cfeb2f762
DATA[NBF]root.Data
BIN8cfeb2f763
DATA[NBF]root.Data
BIN8cfeb2f764
DATA[NBF]root.Data
BIN8cfeb2f765
DATA[NBF]root.Data
BIN8cfeb2f766
DATA[NBF]root.Data
BIN8cfeb2f767
DATA[NBF]root.Data
BIN8cfeb2f768
DATA[NBF]root.Data
BIN8cfeb2f769
DATA[NBF]root.Data
BIN8cfeb2f77
DATA[NBF]root.Data
BIN8cfeb2f770
DATA[NBF]root.Data
BIN8cfeb2f771
DATA[NBF]root.Data
BIN8cfeb2f772
DATA[NBF]root.Data
BIN8cfeb2f773
DATA[NBF]root.Data
BIN8cfeb2f774
DATA[NBF]root.Data
BIN8cfeb2f775
DATA[NBF]root.Data
BIN8cfeb2f776
DATA[NBF]root.Data
BIN8cfeb2f777
DATA[NBF]root.Data
BIN8cfeb2f778
DATA[NBF]root.Data
BIN8cfeb2f779
DATA[NBF]root.Data
BIN8cfeb2f78
DATA[NBF]root.Data
BIN8cfeb2f780
DATA[NBF]root.Data
BIN8cfeb2f781
DATA[NBF]root.Data
BIN8cfeb2f782
DATA[NBF]root.Data
BIN8cfeb2f783
DATA[NBF]root.Data
BIN8cfeb2f784
DATA[NBF]root.Data
BIN8cfeb2f785
DATA[NBF]root.Data
BIN8cfeb2f786
DATA[NBF]root.Data
BIN8cfeb2f787
DATA[NBF]root.Data
BIN8cfeb2f788
DATA[NBF]root.Data
BIN8cfeb2f789
DATA[NBF]root.Data
BIN8cfeb2f79
DATA[NBF]root.Data
BIN8cfeb2f790
DATA[NBF]root.Data
BIN8cfeb2f791
DATA[NBF]root.Data
BIN8cfeb2f792
DATA[NBF]root.Data
BIN8cfeb2f793
DATA[NBF]root.Data
BIN8cfeb2f794
DATA[NBF]root.Data
BIN8cfeb2f795
DATA[NBF]root.Data
BIN8cfeb2f796
DATA[NBF]root.Data
BIN8cfeb2f797
DATA[NBF]root.Data
BIN8cfeb2f798
DATA[NBF]root.Data
BIN8cfeb2f799
DATA[NBF]root.Data
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Reflective Loader
EXEMaselatki.562567.tsx [AES Decrypted]T1059.007
Structure
BINOverlay_fef55cbd.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINAttachedParser.TokenParser
BINOperationalParser.HiddenParser
BINDetachedParser.ParserFactory
BINParserEditor.ParserElement
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
arc:rar>pe:exe>pe:dll~T1059.007>pe:rsrc>bin
Shape
arc:rar>pe:exe>pe:dll>pe:rsrc>bin
malicious
5 nodes
Path
arc:rar>pe:exe>pe:dll~T1059.007>bin
Shape
arc:rar>pe:exe>pe:dll>bin
malicious
4 nodes
3 malicious · 584 files
RAR517b77d282d81a15a17f83759108d7eaT1059.007.NET Reflective Loader
EXEDahnay Presentation (3)-compressed.exeT1059.007.NET Reflective Loader
Structure
BIN.Net Resources
BINResources
BIN.Net Reflective Loader
EXEMaselatki.562567.tsx [AES Decrypted]T1059.007
Structure
BINOverlay_fef55cbd.bin
BINResources
BIN.Net Resources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account