Malicious
Malicious

52516a951d018b0131be36f4835a1d27

Share on LinkedIn
Print
PE Executable
MD5: 52516a951d018b0131be36f4835a1d27
Size: 2 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 52516a951d018b0131be36f4835a1d27
Sha1 f5ca9a4c80567d1c2ff6ba493a62d88e1ee3a5f1
Sha256 2780990915f461b0e76cb57a125a730646cda5e37071cb9a5addc820b1febac2
Sha384 f2fdc7ab721fa9fbad948c13f21bfd1ba48e81941cd9b80831a593378f2524ba9de2e91cf589d1a8a2c0fe5d450a92c3
Sha512 b79f8dd7eb8bc8201d50069cb4fea05a11903777894fb9d806eb213ef5a32cfdee2dd431235bf8188be462dd704d7afab3246f91fe4c68dbfb3c5be79574b836
SSDeep 24576:32yWGWRCcV/Cov8XgVEW0fIdGh/UDt343AjMKzf/s3TVO1FCY8zlauRJWJ9yu:GTfV/C+8Xg/0fm6sRIesTVO10rR1u
TLSH D495D03036B6D149E5BA0B710CB556C027B63B667E44CB4D6898224DDD33B27CB12EEB
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
52516a951d018b0131be36f4835a1d27
Malicious
.Net Resources
ND.Nb.resources
panel1.Dock
panel1.Size
checkThink.Anchor
richTextMsg.Size
richTextMsg.Font
butEdit.Margin
butRegen.Image
[NBF]root.Data
[NBF]root.Data-preview.png
butDelete.Size
labelRole.Size
labelRole.Font
butRegen.Location
butEdit.Location
butEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
richTextMsg.ScrollBars
richTextMsg.Anchor
butDelete.Image
[NBF]root.Data
[NBF]root.Data-preview.png
checkThink.Location
butDelete.Location
checkThink.Size
labelRole.Location
richTextMsg.Location
$this.AutoScaleDimensions
butCancelEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
panel1.Location
butApplyEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
UeS.EeJ.resources
radioBasicVAD.Margin
toolStripStatusLabel1.Size
label10.Margin
tabPageHuggingFace.Location
numFreqThreshold.Location
listViewMeta.Size
checkCMDEnable.ImeMode
numCtxSize.Location
checkMLock.Location
checkLoadAuto.Anchor
textGoogleApiKey.Location
checkOverrideJinjaModel.TextAlign
textSearchTerm.Anchor
butSearch.Location
label12.Size
butVADDown.Location
radioBasicVAD.Size
groupCommon.Location
numMinP.Location
numVadThreshold.Location
checkOverrideSettings.Location
label13.Size
groupCommonModel.Size
checkStream.Size
label16.Size
textSystemPrompt.Location
numGenDelay.Location
numTemp.Location
label14.Size
label28.Location
$this.Icon
[NBF]root.IconData
checkMarkdown.Location
label17.Size
label19.Location
tabControl1.Size
checkFileListEnable.Size
label15.Size
label30.Margin
comboVADModel.Size
checkStream.Location
butApplyModelSettings.Location
labelEditing.Size
labelEditing.Font
label7.Location
label10.Location
checkFileCreateEnable.Location
panelChat.Size
label19.Size
numTopK.Location
label20.Size
checkDateTimeEnable.Location
groupAdvanced.Location
$this.ClientSize
label22.Size
butApply.Location
checkMarkdown.Size
numWhisperTemp.Location
textInput.Size
label22.Location
statusStrip1.Size
label3.Size
groupBox8.Size
listViewHugSearch.Size
textSearchTerm.Location
butGen.Location
label1.Size
textModelsPath.Location
numWhisperTemp.Size
comboVADModel.Location
groupBox6.Size
groupBox7.Size
groupAdvancedModel.Size
labelTPS.Size
groupBox4.Size
butSearch.Size
label29.Location
textInput.ScrollBars
numWakeWordSimilarity.Location
numApiServerPort.Location
groupBox2.Size
label8.Location
checkFlashAttnModel.Location
label12.Location
label20.Location
label23.Location
checkOverrideJinjaModel.Location
statusStrip1.Padding
label11.Location
checkVoiceInput.Location
groupBox1.Size
splitContainer2.Orientation
butBrowse.Location
numTopP.Location
labelPreGen.Size
numGoogleResults.Location
splitContainer1.Size
groupBox4.Location
checkFileReadEnable.Location
panelChat.FlowDirection
textModelsPath.Size
splitContainer3.Size
labelSystemPromptModel.Size
butWhispDown.Location
numTopPModel.Location
groupCPUParamsBatch.Size
label9.Location
textSearchTerm.Size
checkFlashAttn.Location
textJinjaTmplModel.Location
labelTokens.Size
butReset.Location
checkDialectic.Location
checkWhisperUseGPU.Location
listViewHugFiles.Size
checkAutoScroll.Size
groupBox6.Location
groupBox5.Location
checkFileWriteEnable.Size
splitContainer3.Location
textGoogleSearchID.Size
labelSystemPromptModel.Location
label13.Location
butVADDown.Size
label30.Size
label30.Location
label21.Location
progressBar1.Size
checkMMap.Location
linkFileInstruction.Location
FV7
groupAdvanced.Size
textGoogleApiKey.Size
label14.Location
checkAutoScroll.Location
statusStrip1.Location
textSystemPromptModel.Size
groupBox7.Location
butGen.Anchor
textFileBasePath.Size
textJinjaTmplModel.Size
label26.Location
butCodeBlock.Location
groupCommon.Size
checkVoiceInput.Size
comboNUMAStrat.Size
checkSpeak.Location
textSystemPrompt.Size
progressBar1.Anchor
linkFileInstruction.Size
checkFileWriteEnable.Location
label16.Location
label24.Location
numRepPen.Location
checkDialectic.Size
textWakeWord.Size
label15.Location
comboWhisperModel.Location
toolTip1.TrayLocation
groupCPUParamsBatch.Location
tabPageModelSettings.Size
label3.Location
tabPageSettings.Size
butCodeBlock.Size
openFileDialog1.TrayLocation
statusStrip1.TrayLocation
checkSpeak.Size
groupBox2.Location
groupBox1.Location
groupCPUParams.Location
listViewModels.Size
$this.StartPosition
checkLoadAuto.Location
numGoogleResults.Size
textSystemPromptModel.Location
textFileBasePath.Location
linkFileInstruction.Anchor
label17.Location
groupCommonModel.Location
butBrowseJinjaTmplModel.Location
numBatchSize.Location
label25.Location
groupAdvancedModel.Location
label4.Location
textWakeWord.Location
folderBrowserDialog1.TrayLocation
tabControlModelStuff.Size
groupBox8.Location
$this.AutoScaleDimensions
checkLoadAuto.Size
numNGen.Location
textGoogleSearchID.Location
label18.Location
groupJinjaTmplModel.Location
label6.Location
checkOverrideSettings.Size
checkApiServerEnable.Location
groupBox3.Location
kVps.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
LMStud.Properties.Resources.resources
NVLq
[NBF]root.Data
[NBF]root.Data-preview.png
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Name Value
Module Name
kVps.exe
Full Name
kVps.exe
EntryPoint
System.Void F7J.r7o::F7S()
Scope Name
kVps.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kVps
Assembly Version
8.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
673
Main Method
System.Void F7J.r7o::F7S()
Main IL Instruction Count
12
Main IL 
br IL_0010: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_001A: call System.Void LOm.EOY::vTb()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0005: ldc.i4.0
call System.Void LOm.EOY::vTb()
br IL_0024: newobj System.Void UeS.EeJ::.ctor()
newobj System.Void UeS.EeJ::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0033: ret
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: kVps.pdb
An error has occurred. This application may no longer respond until reloaded. Reload 🗙