Suspect
PE Executable
MD5: 6da5f33515b187df3620e7463fab9995
Size: 5.3 MB
application/x-dosexec
This sample is a 5.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- b9cf80a5e63577b018937534f6219eb29876c2163f0cdad7341acc2deef2859f
- MD5
- 6da5f33515b187df3620e7463fab9995
- Verdict
- Inconclusive
- File type
- PE Executable · 5.1 MB
Cite this report: https://app.malva.re/sha256/b9cf80a5e63577b018937534f6219eb29876c2163f0cdad7341acc2deef2859f
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
5.3 MB · 5,298,176 B
First seen
2026-08-07 20:30 · 2 months ago
Last seen
2026-08-07 20:30 · 2 months ago
Last analysis
2026-08-07 20:30 · 2 months ago
Hashes
MD5
6da5f33515b187df3620e7463fab9995
Sha1
02c8512b8bc8cce7e46a4d28ea46250076edef9c
Sha256
b9cf80a5e63577b018937534f6219eb29876c2163f0cdad7341acc2deef2859f
Sha384
4b528ebec2915f33b3bff56b5ce4ecfcd4cace08f3dc80ab4caa75f8233e7ae9ece2ae06fac387c54f2fd568b96966ec
Sha512
667b4aeb02a561871e4d85d1db0ac46d3cbaa72cf904459e0aa402b15ec53915a9c4e4c519e0c3204d010667b182ab2237e57e6b25d734d7a7eab2ae747f8426
SSDeep
24576:jbLg8bLguVQhfdmMSirYbcMNgef0QeQjG:jnRnFQqMSPbcBVQej
TLSH
EC36125A326C80BCC11B6274A4B34E26E7B37C5A227D930F8B5487661E13790BF78B57
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLMicrosoft v12.00 64bit C++ DLL - sign ASL ( 64 bit ) UPolyX 0.3 -> delikon
1 file
EXE6da5f33515b187df3620e7463fab9995
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll
Shape
pe:dll
1 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential