Malicious
Malicious

7ca953257b585200fedbf4579cf3ba3d

PE Executable
MD5: 7ca953257b585200fedbf4579cf3ba3d
Size: 419.33 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 409.5 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
00f7ddb0a6adfe53bb534557668ab741e3522ed459f19b316c3c46069183eeba
MD5
7ca953257b585200fedbf4579cf3ba3d
Verdict
Malicious
File type
PE Executable · 409.5 KB

Cite this report: https://app.malva.re/sha256/00f7ddb0a6adfe53bb534557668ab741e3522ed459f19b316c3c46069183eeba

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
419.33 KB · 419,328 B
First seen
2026-11-01 07:00 · 3 hours ago
Last seen
2026-11-01 07:00 · 3 hours ago
Last analysis
2026-11-01 07:00 · 3 hours ago
Hashes
MD5 7ca953257b585200fedbf4579cf3ba3d Sha1 768ee4977a095b2cf4f391521489e2d7886ded43 Sha256 00f7ddb0a6adfe53bb534557668ab741e3522ed459f19b316c3c46069183eeba Sha384 73aa4da471164fef918a2dd8a20cfdd0af9c668644b6872f70f957a7fa56e7a76b7b8fc8904c2972365ce5f7f0e9f6e1 Sha512 bfe1351f0a9da30a65b645582a41d5c37346fbea6c0cc36dc1f9ab37266b8b46fab5c78f91725c25bf202f2ef4887e893bf954da3fef88f320066c7149e42c97 SSDeep 6144:kl1Qx+8g6s6EjEG8hxlSa87efmLXZGcnPgGzZ:ksjqwMa87omLXZGcPgk TLSH C794281B36914F21C29D0733E1DB450293EA95873ABBE72F358413DA19023FEDA4B697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE7ca953257b585200fedbf4579cf3ba3d
Structure
BIN.Net Resources
BINrW51IVhGb1ij3Bky3H.WwLWZjlga6fal4Npbx
BINWMcOifmlKwFNvHaF6C.WRlG5ejVJvFgRdiUqk
BINnsOVyX0VLFscObtViX.L7HgG94ACLbnStVrt1
BINNLBP8Aab9ylQwg02Sj.sIvFe2ImFpE1yKmOkg
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Basonthjte.exe
Full Name
Basonthjte.exe
EntryPoint
System.Void mYjjZ1MD6XvxfHboEH.oTlBGCkWENKW3VNUOL::qSQxC4RvM()
Scope Name
Basonthjte.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Basonthjte
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void mYjjZ1MD6XvxfHboEH.oTlBGCkWENKW3VNUOL::qSQxC4RvM()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0189: ldsfld bLm0ZqkBPvtaobAxIOu bLm0ZqkBPvtaobAxIOu::opvkFYdOAH
ret <null>
nop <null>
ldsfld DUEyy5kwG85pUVrjwX4 DUEyy5kwG85pUVrjwX4::su7kUrVl1e
call System.Byte[] DUEyy5kwG85pUVrjwX4::WpUkde2eTo(DUEyy5kwG85pUVrjwX4)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_52398a84fdbb4b93bad38be5bca13af7
brfalse IL_0077: switch(IL_0112,IL_0097)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0112,IL_0097)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0097: ldc.i4 826969672
ldc.i4 826969672
ldc.i4 229228959
xor <null>
ldc.i4 1299176037
xor <null>
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_696318f58f16407abb70a1be0b72cc89
xor <null>
ldsfld onGVjPkiiREtW8DbLLj onGVjPkiiREtW8DbLLj::vPvk2Lsbbn
call System.String onGVjPkiiREtW8DbLLj::WpUkde2eTo(System.Int32,onGVjPkiiREtW8DbLLj)
ldc.i4 652990586
ldc.i4 1804523983
xor <null>
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_ff5bdfb43b34494880acbe905828a92d
xor <null>
ldsfld onGVjPkiiREtW8DbLLj onGVjPkiiREtW8DbLLj::vPvk2Lsbbn
call System.String onGVjPkiiREtW8DbLLj::WpUkde2eTo(System.Int32,onGVjPkiiREtW8DbLLj)
newobj System.Void XTFgTDG7f732VFQVMX.TDyL1g6M931qw2kOEy::.ctor(System.String,System.String)
newobj System.Void MJ1Qeeab9VdVMCU9u8N.mfUv0taNF7jpK5AHnhv::.ctor(XTFgTDG7f732VFQVMX.TDyL1g6M931qw2kOEy)
ldloc.s V_1
ldsfld MofIaykulQr57B8WFR6 MofIaykulQr57B8WFR6::OhpkTFN51b
call System.Void MofIaykulQr57B8WFR6::WpUkde2eTo(System.Object,System.Byte[],MofIaykulQr57B8WFR6)
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_f87353c455bc4997a5f335c528278368
brfalse IL_0077: switch(IL_0112,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0112,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_ddd118502af844ea9c7235afdf27ddcf
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 0
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 6
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_928536fccb234e449e2bf3efaf49bb29
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld bLm0ZqkBPvtaobAxIOu bLm0ZqkBPvtaobAxIOu::opvkFYdOAH
call System.Void bLm0ZqkBPvtaobAxIOu::WpUkde2eTo(bLm0ZqkBPvtaobAxIOu)
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_d9975c21bdff432b94f45f3b5b958542
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
Module Name
Basonthjte.exe
Full Name
Basonthjte.exe
EntryPoint
System.Void mYjjZ1MD6XvxfHboEH.oTlBGCkWENKW3VNUOL::qSQxC4RvM()
Scope Name
Basonthjte.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Basonthjte
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void mYjjZ1MD6XvxfHboEH.oTlBGCkWENKW3VNUOL::qSQxC4RvM()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0189: ldsfld bLm0ZqkBPvtaobAxIOu bLm0ZqkBPvtaobAxIOu::opvkFYdOAH
ret <null>
nop <null>
ldsfld DUEyy5kwG85pUVrjwX4 DUEyy5kwG85pUVrjwX4::su7kUrVl1e
call System.Byte[] DUEyy5kwG85pUVrjwX4::WpUkde2eTo(DUEyy5kwG85pUVrjwX4)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_52398a84fdbb4b93bad38be5bca13af7
brfalse IL_0077: switch(IL_0112,IL_0097)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0112,IL_0097)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0097: ldc.i4 826969672
ldc.i4 826969672
ldc.i4 229228959
xor <null>
ldc.i4 1299176037
xor <null>
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_696318f58f16407abb70a1be0b72cc89
xor <null>
ldsfld onGVjPkiiREtW8DbLLj onGVjPkiiREtW8DbLLj::vPvk2Lsbbn
call System.String onGVjPkiiREtW8DbLLj::WpUkde2eTo(System.Int32,onGVjPkiiREtW8DbLLj)
ldc.i4 652990586
ldc.i4 1804523983
xor <null>
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_ff5bdfb43b34494880acbe905828a92d
xor <null>
ldsfld onGVjPkiiREtW8DbLLj onGVjPkiiREtW8DbLLj::vPvk2Lsbbn
call System.String onGVjPkiiREtW8DbLLj::WpUkde2eTo(System.Int32,onGVjPkiiREtW8DbLLj)
newobj System.Void XTFgTDG7f732VFQVMX.TDyL1g6M931qw2kOEy::.ctor(System.String,System.String)
newobj System.Void MJ1Qeeab9VdVMCU9u8N.mfUv0taNF7jpK5AHnhv::.ctor(XTFgTDG7f732VFQVMX.TDyL1g6M931qw2kOEy)
ldloc.s V_1
ldsfld MofIaykulQr57B8WFR6 MofIaykulQr57B8WFR6::OhpkTFN51b
call System.Void MofIaykulQr57B8WFR6::WpUkde2eTo(System.Object,System.Byte[],MofIaykulQr57B8WFR6)
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_f87353c455bc4997a5f335c528278368
brfalse IL_0077: switch(IL_0112,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0112,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_ddd118502af844ea9c7235afdf27ddcf
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 0
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 6
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_928536fccb234e449e2bf3efaf49bb29
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld bLm0ZqkBPvtaobAxIOu bLm0ZqkBPvtaobAxIOu::opvkFYdOAH
call System.Void bLm0ZqkBPvtaobAxIOu::WpUkde2eTo(bLm0ZqkBPvtaobAxIOu)
ldc.i4 0
ldsfld <Module>{0447c5c2-99ef-496f-a367-615c145b79a9} <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_46edfe37f739487e9b618497c98b9f4f
ldfld System.Int32 <Module>{0447c5c2-99ef-496f-a367-615c145b79a9}::m_d9975c21bdff432b94f45f3b5b958542
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0189)

1 malicious · 7 files
EXE7ca953257b585200fedbf4579cf3ba3d
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙