Sign up free
Suspicious
Suspect

5d2c2da3e4f001b1cf99d06d0ae676c1

Share on LinkedIn
Print
PE Executable
MD5: 5d2c2da3e4f001b1cf99d06d0ae676c1
Size: 1.1 MB
application/x-dosexec

This sample is a 1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 15 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308
MD5
5d2c2da3e4f001b1cf99d06d0ae676c1
Verdict
Inconclusive
File type
PE Executable · 1 MB

Cite this report: https://app.malva.re/sha256/4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.1 MB · 1,100,800 B
First seen
2026-10-19 07:45 · 14 days ago
Last seen
2026-10-19 07:45 · 14 days ago
Last analysis
2026-10-19 07:46 · 14 days ago
Hashes
MD5 5d2c2da3e4f001b1cf99d06d0ae676c1 Sha1 e76ff00c51fe5daacbae40ed8f96b67c3b32dde7 Sha256 4ddba4d5600dc9bb4a88be881700c90ddc3fcd84aa8943c7eacd09a6442a3308 Sha384 b68d7462345932492d9996358f520a8ddb811dc920b9a0a65504b51ba391503cd77e5c747d75976f98390de08492075d Sha512 51b943142653e7d573339717da8754280881c26daa6ff4527d11411aef12aa5a089e0d340e87f5e7e6ff765a203ca4ca96dc6f4281d09b97f0c2cf41cf4c784b SSDeep 24576:JMAr2gM2WsXZg0nDP8j48yJiIyp0PWv9h57WM7aKVv0JD7eRB:rvJTpg0DP8EhH2ZaCuJneR TLSH 78350254221ADD02C4921FB50A72E7F81B189FE8E912C313DFFE7EEFB9796252805251
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

16 files
EXE5d2c2da3e4f001b1cf99d06d0ae676c1
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Module Name
gYOk.exe
Full Name
gYOk.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
gYOk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gYOk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\zyYLyHvezW\src\obj\Debug\gYOk.pdb
Module Name
gYOk.exe
Full Name
gYOk.exe
EntryPoint
System.Void AdminKütüphane.Program::Main()
Scope Name
gYOk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gYOk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
121
Main Method
System.Void AdminKütüphane.Program::Main()
Main IL Instruction Count
32
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void AdminKütüphane.MainPage::.ctor()
stloc.0 <null>
newobj System.Void AdminKütüphane.Login::.ctor()
stloc.1 <null>
nop <null>
ldloc.1 <null>
callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog()
ldc.i4.1 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0031: nop
nop <null>
ldloc.0 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
nop <null>
leave.s IL_003F: ret
ldloc.1 <null>
brfalse.s IL_003E: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙