Suspicious
Suspect

54286faf6dfe4ef44ddd919f504146de

PE Executable
MD5: 54286faf6dfe4ef44ddd919f504146de
Size: 198.14 KB
application/x-dosexec

This sample is a 193.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
2d768d8784e7979d8ef9acf538dc3fa367b4992f4d3a43f47b945520a2cb14cb
MD5
54286faf6dfe4ef44ddd919f504146de
Verdict
Inconclusive
File type
PE Executable · 193.5 KB

Cite this report: https://app.malva.re/sha256/2d768d8784e7979d8ef9acf538dc3fa367b4992f4d3a43f47b945520a2cb14cb

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
198.14 KB · 198,144 B
First seen
2026-10-28 11:00 · 8 hours ago
Last seen
2026-10-28 11:00 · 8 hours ago
Last analysis
2026-10-28 11:00 · 8 hours ago
Hashes
MD5 54286faf6dfe4ef44ddd919f504146de Sha1 f3b8d350c1a87413f1a44226b1a1505df04d7dac Sha256 2d768d8784e7979d8ef9acf538dc3fa367b4992f4d3a43f47b945520a2cb14cb Sha384 fdb8d93b17cb8c4e2a67091132e5e81a2156c5512d35d903a2e0090fad16cad15e5e8dad092ffb022aff5949e1914508 Sha512 4f1b0c6c569643fdfa79cae496a8b370c2175980b880229fb9f9bf125be63cbf814433889d31fded9aedb2f1be6eb27968e7a29daf55e7507fa266a8b3fc925d SSDeep 6144:WHbfxbjhq6R+rAVK++VryPPkZPxv2SHwYsMXq:CJbtVl2yPPu2SQYsMXq TLSH 541413E9113AE3F9F514607964A251963AA28C266EDF571A85E0F31FA0B03BF47035EC
Detection
PeID
x64 - UPX exe - NRV2E/7 compression UPX v3.95 -> dhondta

2 files
EXE54286faf6dfe4ef44ddd919f504146de
Structure
EXE[UPX unpacked Nrv2ELe32].exe
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe
Shape pe:exe
1 nodes

Name Value
UPX
UPX method: Nrv2ELe32, filter: X86CallJump
UPX 
UPX anomaly: PE reconstructed from saved NT headers; DOS stub retained; PE checksum cleared; overlay not restored
UPX 
UPX anomaly: UPX declared original file size differs from reconstructed file (overlay or modified header)

2 files
EXE54286faf6dfe4ef44ddd919f504146de
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙