52516a951d018b0131be36f4835a1d27

PE Executable

MD5: 52516a951d018b0131be36f4835a1d27

Size: 2 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

2 MB · 1,997,824 B

First seen

2026-09-10 14:30 · one month ago

Last seen

2026-09-10 14:30 · one month ago

Last analysis

2026-09-10 14:30 · one month ago

Hashes

MD5 52516a951d018b0131be36f4835a1d27 Sha1 f5ca9a4c80567d1c2ff6ba493a62d88e1ee3a5f1 Sha256 2780990915f461b0e76cb57a125a730646cda5e37071cb9a5addc820b1febac2 Sha384 f2fdc7ab721fa9fbad948c13f21bfd1ba48e81941cd9b80831a593378f2524ba9de2e91cf589d1a8a2c0fe5d450a92c3 Sha512 b79f8dd7eb8bc8201d50069cb4fea05a11903777894fb9d806eb213ef5a32cfdee2dd431235bf8188be462dd704d7afab3246f91fe4c68dbfb3c5be79574b836 SSDeep 24576:32yWGWRCcV/Cov8XgVEW0fIdGh/UDt343AjMKzf/s3TVO1FCY8zlauRJWJ9yu:GTfV/C+8Xg/0fm6sRIesTVO10rR1u TLSH D495D03036B6D149E5BA0B710CB556C027B63B667E44CB4D6898224DDD33B27CB12EEB

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Medium

1 malicious · 256 files

EXE52516a951d018b0131be36f4835a1d27

Structure

BIN.Net Resources

BINND.Nb.resources

DOCKpanel1.Dock

SIZEpanel1.Size

BINcheckThink.Anchor

SIZErichTextMsg.Size

FONTrichTextMsg.Font

BINbutEdit.Margin

BINbutRegen.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

SIZEbutDelete.Size

SIZElabelRole.Size

FONTlabelRole.Font

BINbutRegen.Location

BINbutEdit.Location

BINbutEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINrichTextMsg.ScrollBars

BINrichTextMsg.Anchor

BINbutDelete.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINcheckThink.Location

BINbutDelete.Location

SIZEcheckThink.Size

BINlabelRole.Location

BINrichTextMsg.Location

BIN$this.AutoScaleDimensions

BINbutCancelEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINpanel1.Location

BINbutApplyEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINUeS.EeJ.resources

BINradioBasicVAD.Margin

SIZEtoolStripStatusLabel1.Size

BINlabel10.Margin

BINtabPageHuggingFace.Location

BINnumFreqThreshold.Location

SIZElistViewMeta.Size

BINcheckCMDEnable.ImeMode

BINnumCtxSize.Location

BINcheckMLock.Location

BINcheckLoadAuto.Anchor

BINtextGoogleApiKey.Location

BINcheckOverrideJinjaModel.TextAlign

BINtextSearchTerm.Anchor

BINbutSearch.Location

SIZElabel12.Size

BINbutVADDown.Location

SIZEradioBasicVAD.Size

BINgroupCommon.Location

BINnumMinP.Location

BINnumVadThreshold.Location

BINcheckOverrideSettings.Location

SIZElabel13.Size

SIZEgroupCommonModel.Size

SIZEcheckStream.Size

SIZElabel16.Size

BINtextSystemPrompt.Location

BINnumGenDelay.Location

BINnumTemp.Location

SIZElabel14.Size

BINlabel28.Location

ICON$this.Icon

BIN[NBF]root.IconData

BINcheckMarkdown.Location

SIZElabel17.Size

BINlabel19.Location

SIZEtabControl1.Size

SIZEcheckFileListEnable.Size

SIZElabel15.Size

BINlabel30.Margin

SIZEcomboVADModel.Size

BINcheckStream.Location

BINbutApplyModelSettings.Location

SIZElabelEditing.Size

FONTlabelEditing.Font

BINlabel7.Location

BINlabel10.Location

BINcheckFileCreateEnable.Location

SIZEpanelChat.Size

SIZElabel19.Size

BINnumTopK.Location

SIZElabel20.Size

BINcheckDateTimeEnable.Location

BINgroupAdvanced.Location

BIN$this.ClientSize

SIZElabel22.Size

BINbutApply.Location

SIZEcheckMarkdown.Size

BINnumWhisperTemp.Location

SIZEtextInput.Size

BINlabel22.Location

SIZEstatusStrip1.Size

SIZElabel3.Size

SIZEgroupBox8.Size

SIZElistViewHugSearch.Size

BINtextSearchTerm.Location

BINbutGen.Location

SIZElabel1.Size

BINtextModelsPath.Location

SIZEnumWhisperTemp.Size

BINcomboVADModel.Location

SIZEgroupBox6.Size

SIZEgroupBox7.Size

SIZEgroupAdvancedModel.Size

SIZElabelTPS.Size

SIZEgroupBox4.Size

SIZEbutSearch.Size

BINlabel29.Location

BINtextInput.ScrollBars

BINnumWakeWordSimilarity.Location

BINnumApiServerPort.Location

SIZEgroupBox2.Size

BINlabel8.Location

BINcheckFlashAttnModel.Location

BINlabel12.Location

BINlabel20.Location

BINlabel23.Location

BINcheckOverrideJinjaModel.Location

BINstatusStrip1.Padding

BINlabel11.Location

BINcheckVoiceInput.Location

SIZEgroupBox1.Size

BINsplitContainer2.Orientation

BINbutBrowse.Location

BINnumTopP.Location

SIZElabelPreGen.Size

BINnumGoogleResults.Location

SIZEsplitContainer1.Size

BINgroupBox4.Location

BINcheckFileReadEnable.Location

BINpanelChat.FlowDirection

SIZEtextModelsPath.Size

SIZEsplitContainer3.Size

SIZElabelSystemPromptModel.Size

BINbutWhispDown.Location

BINnumTopPModel.Location

SIZEgroupCPUParamsBatch.Size

BINlabel9.Location

SIZEtextSearchTerm.Size

BINcheckFlashAttn.Location

BINtextJinjaTmplModel.Location

SIZElabelTokens.Size

BINbutReset.Location

BINcheckDialectic.Location

BINcheckWhisperUseGPU.Location

SIZElistViewHugFiles.Size

SIZEcheckAutoScroll.Size

BINgroupBox6.Location

BINgroupBox5.Location

SIZEcheckFileWriteEnable.Size

BINsplitContainer3.Location

SIZEtextGoogleSearchID.Size

BINlabelSystemPromptModel.Location

BINlabel13.Location

SIZEbutVADDown.Size

SIZElabel30.Size

BINlabel30.Location

BINlabel21.Location

SIZEprogressBar1.Size

BINcheckMMap.Location

BINlinkFileInstruction.Location

BINFV7

SIZEgroupAdvanced.Size

SIZEtextGoogleApiKey.Size

BINlabel14.Location

BINcheckAutoScroll.Location

BINstatusStrip1.Location

SIZEtextSystemPromptModel.Size

BINgroupBox7.Location

BINbutGen.Anchor

SIZEtextFileBasePath.Size

SIZEtextJinjaTmplModel.Size

BINlabel26.Location

BINbutCodeBlock.Location

SIZEgroupCommon.Size

SIZEcheckVoiceInput.Size

SIZEcomboNUMAStrat.Size

BINcheckSpeak.Location

SIZEtextSystemPrompt.Size

BINprogressBar1.Anchor

SIZElinkFileInstruction.Size

BINcheckFileWriteEnable.Location

BINlabel16.Location

BINlabel24.Location

BINnumRepPen.Location

SIZEcheckDialectic.Size

SIZEtextWakeWord.Size

BINlabel15.Location

BINcomboWhisperModel.Location

BINtoolTip1.TrayLocation

BINgroupCPUParamsBatch.Location

SIZEtabPageModelSettings.Size

BINlabel3.Location

SIZEtabPageSettings.Size

SIZEbutCodeBlock.Size

BINopenFileDialog1.TrayLocation

BINstatusStrip1.TrayLocation

SIZEcheckSpeak.Size

BINgroupBox2.Location

BINgroupBox1.Location

BINgroupCPUParams.Location

SIZElistViewModels.Size

BIN$this.StartPosition

BINcheckLoadAuto.Location

SIZEnumGoogleResults.Size

BINtextSystemPromptModel.Location

BINtextFileBasePath.Location

BINlinkFileInstruction.Anchor

BINlabel17.Location

BINgroupCommonModel.Location

BINbutBrowseJinjaTmplModel.Location

BINnumBatchSize.Location

BINlabel25.Location

BINgroupAdvancedModel.Location

BINlabel4.Location

BINtextWakeWord.Location

BINfolderBrowserDialog1.TrayLocation

SIZEtabControlModelStuff.Size

BINgroupBox8.Location

BIN$this.AutoScaleDimensions

SIZEcheckLoadAuto.Size

BINnumNGen.Location

BINtextGoogleSearchID.Location

BINlabel18.Location

BINgroupJinjaTmplModel.Location

BINlabel6.Location

SIZEcheckOverrideSettings.Size

BINcheckApiServerEnable.Location

BINgroupBox3.Location

BINkVps.g.resources

BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources

ICON$this.Icon

BIN[NBF]root.IconData

BINprogressBar1.Modifiers

BIN$this.Language

BIN$this.GridSize

BINLMStud.Properties.Resources.resources

BINNVLq

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINResources

BINRT_ICON

BINID:0001

BINID:0

BINID:0002

BINID:0

BINID:0003

BINID:0

BINID:0004

BINID:0

BINID:0005

BINID:0

BINID:0006

IMGID:0

IMGID:0-preview.png

BINRT_GROUP_CURSOR4

BINID:7F00

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Name	Value
Module Name	kVps.exe
Full Name	kVps.exe
EntryPoint	System.Void F7J.r7o::F7S()
Scope Name	kVps.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kVps
Assembly Version	8.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	673
Main Method	System.Void F7J.r7o::F7S()
Main IL Instruction Count	12
Main IL	br IL_0010: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_001A: call System.Void LOm.EOY::vTb() call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0005: ldc.i4.0 call System.Void LOm.EOY::vTb() br IL_0024: newobj System.Void UeS.EeJ::.ctor() newobj System.Void UeS.EeJ::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0033: ret ret <null>
Info	PDB Path: kVps.pdb

1 malicious · 256 files

EXE52516a951d018b0131be36f4835a1d27

Structure

BIN.Net Resources

BINResources

No malware configuration was found at this point.