Malicious PE Executable analysis – 09a511feeb10

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.12 MB · 1,118,208 B

First seen

2026-07-27 07:01 · 3 months ago

Last seen

2026-07-27 07:01 · 3 months ago

Last analysis

2026-07-27 07:01 · 3 months ago

Hashes

MD5 825820fc81056e0cb65b2ef0dbffac08 Sha1 5818fa3ad64cafd8fad05bf3e93d9f21ab60a3cc Sha256 09a511feeb109ce18780160d2664e3c31cc33a39025f9ec25a677d21e793bdb1 Sha384 355228d9a11c117b4bbe50e2bf07a9534e631ee37f1fd5bb79e43bce27cf54c38a8aed5df17a80fcf66e3506cf5cab29 Sha512 707a42c1010d528e381b73f5248b01413087aa620a386dd90cc41113296c0d4c4342079ed1a04d2c3e4aa9b0b2ad3183b16b6bbc32be80ae2c72f3c0a0c89584 SSDeep 24576:jp50ngTtDEt2Mg9WnzqILl3vw07KApp+JyrZ6nCN:jpGWNlXmzq4xvHKALkC TLSH 0235F1051257D842E0E687B6A8F1C23437B15ECEB8F3C2975FE96FA779253C29194382

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 16 files

EXE825820fc81056e0cb65b2ef0dbffac08

Structure

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	KLAU.exe
Full Name	KLAU.exe
EntryPoint	System.Void JTV.RTI::kTn()
Scope Name	KLAU.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	KLAU
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	361
Main Method	System.Void JTV.RTI::kTn()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop call System.Void pTQ.LTt::W05() br IL_000F: nop nop <null> newobj System.Void EG.Ys::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0005: call System.Void pTQ.LTt::W05() nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001F: nop`
Module Name	KLAU.exe
Full Name	KLAU.exe
EntryPoint	System.Void JTV.RTI::kTn()
Scope Name	KLAU.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	KLAU
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	361
Main Method	System.Void JTV.RTI::kTn()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop call System.Void pTQ.LTt::W05() br IL_000F: nop nop <null> newobj System.Void EG.Ys::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0005: call System.Void pTQ.LTt::W05() nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001F: nop`