Suspicious
Suspect

69919090f321e9725f0bd035b26d52cc

Share on LinkedIn
Print
PE Executable
MD5: 69919090f321e9725f0bd035b26d52cc
Size: 859.65 KB
application/x-dosexec

This sample is a 839.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 11 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e
MD5
69919090f321e9725f0bd035b26d52cc
Verdict
Inconclusive
File type
PE Executable · 839.5 KB

Cite this report: https://app.malva.re/sha256/301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
859.65 KB · 859,648 B
First seen
2026-09-04 20:30 · one month ago
Last seen
2026-09-04 20:30 · one month ago
Last analysis
2026-09-04 20:31 · one month ago
Hashes
MD5 69919090f321e9725f0bd035b26d52cc Sha1 98690ae5c74c67356c33adb4d6a420ab59562f2b Sha256 301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e Sha384 2882439eb2d5e6e8d7b5fb1dd262de447d28a9ad25fcdcf98dd1bb76e7801cca8192b1f2138426fa270fbf0a3a90545b Sha512 0e3666d14927ed1fbb1271e2d5def2d6f7dface34855d360d0a10dc31329f32dca69e91406a6bd320bcbee14d7dca95f1eb4f4f5e0ef7445b2a6c3c2b2a29683 SSDeep 24576:dsmUGHdJJSA4a8yoTn6eIMuxkB4pHcKAokUPJf:d3UGHfJIa8pTRSp8RokUP TLSH F305F010629DCA1ADCA947B1C476D3F05361BD8AD812F2279AD9BFFB3538F075918382
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

12 files
EXE69919090f321e9725f0bd035b26d52cc
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
uBPC.exe
Full Name
uBPC.exe
EntryPoint
System.Void CloudJar.Program::Main()
Scope Name
uBPC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uBPC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
248
Main Method
System.Void CloudJar.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CloudJar.HauptForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
uBPC.exe
Full Name
uBPC.exe
EntryPoint
System.Void CloudJar.Program::Main()
Scope Name
uBPC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uBPC
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
248
Main Method
System.Void CloudJar.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void CloudJar.HauptForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙