Malicious
Rar Archive
MD5: 517b77d282d81a15a17f83759108d7ea
Size: 3.59 MB
application/vnd.rar
Ctrl + scroll to zoom · drag to pan
This sample is a 3.4 MB Rar Archive identified by Malva.RE as .NET Reflective Loader (loader, crypter). Static analysis extracted 583 embedded or derived files. It matches 18 YARA rules. Observed behaviours map to MITRE ATT&CK T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
- MD5
- 517b77d282d81a15a17f83759108d7ea
- Verdict
- Malicious
- File type
- Rar Archive · 3.4 MB
- Family
- .NET Reflective Loader
- Category
- Loader, Crypter
- MITRE ATT&CK
- T1059.007
Cite this report: https://app.malva.re/sha256/e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
Related .NET Reflective Loader samples
- 847ec4c81c1034be7934e37f6f97cde1ff5b555157b344afd5475ffc71f29091 2026-10-28
- d6055b5594b16f82fce35db1a693e65fcf6209facbd90f755815e0e7b7791e7f 2026-10-19
- 86dfa03616288994385a6aaf1106e1320d92096122b376f2ef6229c73fc1ee0d 2026-10-14
- 08954f9446234a2fafe12537884cfd684df960b6d28527f6777248518ab7e526 2026-10-09
- 08edc0df73427e600402e4f2529d5284b17ccb16f4c24594869ca7e6ddc33936 2026-09-28
- 080dfb9d893d2dd995e8fb81a4098a8d908c563e38d70a8e5bc15debcf1f065a 2026-09-10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Rar archive
Size
3.59 MB · 3,590,520 B
First seen
2026-10-28 11:00 · 4 days ago
Last seen
2026-10-28 11:00 · 4 days ago
Last analysis
2026-10-28 11:01 · 4 days ago
Hashes
MD5
517b77d282d81a15a17f83759108d7ea
Sha1
b1a045508d07c94b03a35a81e68e98966e5d3b1d
Sha256
e4076179d7aea59bc230fd138091d440fc48edf2844b9022835ca162ae428381
Sha384
386004754987b67a6e3d64708c945b6b0495762b85ac7ccda41fb72bb2cfd2c9bc1ab6fa64e0e26b1e2d1efda33af96d
Sha512
9d18961134456a7e71056b65dc2ac1eee259277e7291b7fb71eb66cd1cbd43d21746cb5f33c1c69ec628155a98974b5c536f8748f85cba7350280eca18bbcf01
SSDeep
98304:AoO7pwcCAZGiY3u41ETf3xJ2WX1hv9atquy1gEV:Anm2GiYeHTf3xJFX/YtqbgEV
TLSH
CDF5335EE9CD75BF09C137C67E1829AB74DDBD84848278C096C24A486E1BF1A24FF81D
3 malicious · 584 files
RAR517b77d282d81a15a17f83759108d7eaT1059.007.NET Reflective Loader
EXEDahnay Presentation (3)-compressed.exeT1059.007.NET Reflective Loader
Structure
BIN.Net Resources
BINResources
BIN.Net Reflective Loader
EXEMaselatki.562567.tsx [AES Decrypted]T1059.007
Structure
BINOverlay_fef55cbd.bin
BINResources
BIN.Net Resources
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
arc:rar>pe:exe>pe:dll~T1059.007>pe:rsrc>bin
Shape
arc:rar>pe:exe>pe:dll>pe:rsrc>bin
malicious
5 nodes
Path
arc:rar>pe:exe>pe:dll~T1059.007>bin
Shape
arc:rar>pe:exe>pe:dll>bin
malicious
4 nodes