Suspicious
Suspect

8264f078779b79685c2840d2d4603081

Share on LinkedIn
Print
PE Executable
MD5: 8264f078779b79685c2840d2d4603081
Size: 1.12 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 54 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
cbe3fd488cd7ff4fff16a5a93d2bb5206030824dd50e2237f9d1fb82c96db553
MD5
8264f078779b79685c2840d2d4603081
Verdict
Inconclusive
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/cbe3fd488cd7ff4fff16a5a93d2bb5206030824dd50e2237f9d1fb82c96db553

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.12 MB · 1,122,304 B
First seen
2026-09-10 10:45 · one month ago
Last seen
2026-09-10 10:45 · one month ago
Last analysis
2026-09-10 10:46 · one month ago
Hashes
MD5 8264f078779b79685c2840d2d4603081 Sha1 d3854152516f47f577d9d01b3b69376d6cb71e25 Sha256 cbe3fd488cd7ff4fff16a5a93d2bb5206030824dd50e2237f9d1fb82c96db553 Sha384 c6d56de12ad0e92b16266b8e2552e5d18786cf4452d647856731dc587534cdc55c2aab6f174bde6c69a3e392f51e0366 Sha512 89b8c381d98c28aa4cceb0edb61b986217f96e3e795fa761d8a4be55608541e723607b4443fb27374ce2a39dfb4eaf242f6cc1ea12c5e40a4d415fcaa6ed92bc SSDeep 12288:4JmS5cXTshfhpgagDZp8MSFvfOjOh3X9o9Lm5kNgGUeCRMReLjvI:ymS5Smj6Zp8Mkvm6p6maNdUDRMa TLSH 3E35E021D7461F5AC62F0B7880A31E2837F2DC059E2ECBCBAFFB2D6935166855613583
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

55 files
EXE8264f078779b79685c2840d2d4603081
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
Cnd41Z
Full Name
Cnd41Z
EntryPoint
System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
Scope Name
Cnd41Z
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cnd41Z
Assembly Version
17.15.44.240
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void 3prXk2PdYga.nZb01kYoL5c::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
pop <null>
ret <null>
Module Name
Cnd41Z
Full Name
Cnd41Z
EntryPoint
System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
Scope Name
Cnd41Z
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cnd41Z
Assembly Version
17.15.44.240
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
Main IL Instruction Count
7
Main IL 
nop <null>
newobj System.Void 3prXk2PdYga.nZb01kYoL5c::.ctor()
stloc.0 <null>
ret <null>
ldtoken System.Void 3zcPb0Kr7TmfN.7taPj::9Dtde1QiEs2()
pop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙