Malicious
Malicious

77c9f45ba9801e889db7195e36abef03

Share on LinkedIn
Print
PE Executable
MD5: 77c9f45ba9801e889db7195e36abef03
Size: 619.18 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 604.7 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 102 embedded or derived files. It matches 106 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059, T1059.001, T1059.005 and T1059.007. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
MD5
77c9f45ba9801e889db7195e36abef03
Verdict
Malicious
File type
PE Executable · 604.7 KB
MITRE ATT&CK
T1027T1059T1059.001T1059.005T1059.007

Cite this report: https://app.malva.re/sha256/4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
619.18 KB · 619,178 B
First seen
2026-10-27 18:45 · 2 days ago
Last seen
2026-10-27 18:45 · 2 days ago
Last analysis
2026-10-27 18:45 · 2 days ago
Hashes
MD5 77c9f45ba9801e889db7195e36abef03 Sha1 65db9681e800ebd2af716972cfa0e2c3bf08ec0a Sha256 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c Sha384 9b65f16c63311c4e6e114b7a0e7b8fffb9a44451ce28f1ab413ca18d63a007e02f004c8eb9017676ee7ff1c31f015a19 Sha512 21b967ec4806dc1bb1096f9083fe2d45525d19d1a86bef9d3af8075c56ba59987e2587ccd47675270f6a275755fb431723552f84633824cec5517b235c414e57 SSDeep 12288:R3mgqnIZuYfCYqFet4CovkM7c6GnEIRAQRFehgtq:R3WnIZuMCxezot716BAQRFEOq TLSH 06D48D32A5614033FBF10573B928A6303E7CE728275188A9D7D4AD1D7EB8482A7F7257
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLVC8 -> Microsoft Corporation

62 malicious · 103 files
EXE77c9f45ba9801e889db7195e36abef03
Structure
BIN0
BINOverlay_514150cf.bin
BINu1
BINu2
BINu4
OFFa0
JSi_reUhh9jhTE
PS1JUkEqNhc2S0N
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
VBSySatvUyljdhl
VBSySatvUyljdhl.deobfuscated.vbs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 3secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>ole:doc>scr:ps1~T1027~T1059.001
Shape pe:exe>ole:doc>scr:ps1
malicious 3 nodes
Path pe:exe>ole:doc>scr:vbs~T1027~T1059~T1059.005
Shape pe:exe>ole:doc>scr:vbs
malicious 3 nodes

Name Value
Info
Overlay extracted: Overlay_514150cf.bin (139434 bytes)
Info
PDB Path: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb

Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙