Suspect
PE Executable
MD5: 6e643e3d40a09151088693ae173f3f06
Size: 5.3 MB
application/x-dosexec
This sample is a 5.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- cbc3fb2de79561393eeca4d7b16fd3c86f959bae9c902b5d46887649a230cf7f
- MD5
- 6e643e3d40a09151088693ae173f3f06
- Verdict
- Inconclusive
- File type
- PE Executable · 5.1 MB
Cite this report: https://app.malva.re/sha256/cbc3fb2de79561393eeca4d7b16fd3c86f959bae9c902b5d46887649a230cf7f
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
5.3 MB · 5,298,176 B
First seen
2026-07-26 06:30 · 3 months ago
Last seen
2026-07-26 06:30 · 3 months ago
Last analysis
2026-07-26 15:29 · 3 months ago
Hashes
MD5
6e643e3d40a09151088693ae173f3f06
Sha1
5e0d7bd9e356924f4578b147142331c88fef32ee
Sha256
cbc3fb2de79561393eeca4d7b16fd3c86f959bae9c902b5d46887649a230cf7f
Sha384
9260e11b4d1eb4bb80690355ec1461c755782eab46f6cfbf3dbc9224da3b5f1a5481f03f80915b0b96802e8cef89deb3
Sha512
635d2d7b9947de1d2df1bb321d363510a33e39f80a9a4b2e0a0c5685ef0ea634577cb99b7558d2df754438b430888be73ad64ec8385fab6f75d18f72ea530e79
SSDeep
49152:jnsnUMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMUPoBhz1aRxcSUDk36SAEdhv
TLSH
3536239671B880F8D107257484BB8E12F3B3BC2922FA5A0FAB50497A2E53F46F754753
Detection
PeID
Microsoft Visual C++ v6.0 DLLMicrosoft v12.00 64bit C++ DLL - sign ASL ( 64 bit ) UPolyX 0.3 -> delikon
1 file
EXE6e643e3d40a09151088693ae173f3f06
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll
Shape
pe:dll
1 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential