Malicious PE Executable analysis – 40ef805fbbf3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

898.05 KB · 898,048 B

First seen

2026-09-04 20:30 · one month ago

Last seen

2026-09-04 20:30 · one month ago

Last analysis

2026-09-04 20:32 · one month ago

Hashes

MD5 685edde8c9d6c620f95103765f684f1e Sha1 af87a5209eb1b41026a5d3b417d004b99cf374bb Sha256 40ef805fbbf333e9a2c47bf8ca3832dd854829da0a31469ec5fd271348b6fab4 Sha384 fb60ed387e8f26119fa0753282a3693d2d7300c5b543b55568f18cb68bd98ba42f325770b93693708d8220724b1acaab Sha512 21f2b7f3f46ce5ecd154909f2d855ccad0db9321ce072475c28f983330a06d49b68eb78c37d322218b6d813e985bb9c3f634907f5bd8e2903e4e3c0f51d4e60c SSDeep 24576:vspnmOsm72cKxrIBcDyhtsALtku+kTsew0hqf:en3Ki0yhtrtkuVTO0o TLSH 2515D0082257CB62DD5437B3CAA2DAF026735D96D593C3EB46F87DA73A31B740498283

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 19 files

EXE685edde8c9d6c620f95103765f684f1e

Structure

BIN.Net Resources

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	peeu.exe
Full Name	peeu.exe
EntryPoint	System.Void WN.xx::oy()
Scope Name	peeu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	peeu
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	378
Main Method	System.Void WN.xx::oy()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0021: call System.Void P2p.w2n::ot0() nop <null> newobj System.Void cF.YB::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop call System.Void P2p.w2n::ot0() br IL_0011: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0005: nop`
Module Name	peeu.exe
Full Name	peeu.exe
EntryPoint	System.Void WN.xx::oy()
Scope Name	peeu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	peeu
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	378
Main Method	System.Void WN.xx::oy()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0021: call System.Void P2p.w2n::ot0() nop <null> newobj System.Void cF.YB::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop call System.Void P2p.w2n::ot0() br IL_0011: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0005: nop`