This sample is a 5.4 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 299 embedded or derived files. It matches 39 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- a9b0cde9ea885371e3e698ece8770858cb5cd0a6e499c8f8e5111f229e2e8e10
- MD5
- 57b3af3dc08e81ca266c2d7c0a673f90
- Verdict
- Inconclusive
- File type
- PE Executable · 5.4 MB
Cite this report: https://app.malva.re/sha256/a9b0cde9ea885371e3e698ece8770858cb5cd0a6e499c8f8e5111f229e2e8e10
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
bin
14img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
pe:exe>pe:rsrc>pe:exe>ole:doc>bin>pe:dll>pe:dll
pe:exe>pe:rsrc>pe:exe>ole:doc>bin>pe:dll>pe:dll
pe:exe>pe:rsrc>pe:dll>pe:dll
pe:exe>pe:rsrc>pe:dll>pe:dll
| Name | Value |
|---|---|
| Info | Authenticode present at 0x546200 size 125496 bytes |
| Info | PDB Path: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb |