Suspicious
Suspect

7de577ee2482fd2906e13019020393b1

Share on LinkedIn
Print
PE Executable
MD5: 7de577ee2482fd2906e13019020393b1
Size: 1.03 MB
application/x-dosexec

This sample is a 1002 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 16 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff
MD5
7de577ee2482fd2906e13019020393b1
Verdict
Inconclusive
File type
PE Executable · 1002 KB

Cite this report: https://app.malva.re/sha256/da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.03 MB · 1,026,048 B
First seen
2026-10-19 08:01 · 11 days ago
Last seen
2026-10-19 08:01 · 11 days ago
Last analysis
2026-10-19 08:02 · 11 days ago
Hashes
MD5 7de577ee2482fd2906e13019020393b1 Sha1 bf95a6244fb51c483a3bbcd14c34ee8218bd588f Sha256 da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff Sha384 a3f716825cf098a69d9c545efe55aeb5506c4261926c3f7f1c71a563b8044fcc53579e26e4deb101fe85a254b8c2ab3b Sha512 2f62dc457c0ff95756431373a444c202cdee05ddffa561ebaa169d0d9fe579473041eb5af574c54c998cd1167d40fb0741667a1adf986dd5e409e44cd5bba9d9 SSDeep 24576:SO1mGqPUjRLdFhC5Uaxx9ym4uO3OG0jw1YS4L+k8lb7:SOIoYXh4uO3OGh1mL58Z TLSH 4025E02814274601E9F17EF05E70B1F46B246CAAB139E1295FD20DEBF277211BE4672B
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

17 files
EXE7de577ee2482fd2906e13019020393b1
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Module Name
EwPg.exe
Full Name
EwPg.exe
EntryPoint
System.Void QuanCafe.Program::Main()
Scope Name
EwPg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EwPg
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
245
Main Method
System.Void QuanCafe.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QuanCafe.fLogin::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Info
PDB Path: C:\Users\Administrator\Desktop\Client\Temp\LZvqWvDVrz\src\obj\Debug\EwPg.pdb
Module Name
EwPg.exe
Full Name
EwPg.exe
EntryPoint
System.Void QuanCafe.Program::Main()
Scope Name
EwPg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
EwPg
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
245
Main Method
System.Void QuanCafe.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void QuanCafe.fLogin::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙