Malicious
Malicious

8b998e9d0303ee9340cdc25202142379

Share on LinkedIn
Print
PE Executable
MD5: 8b998e9d0303ee9340cdc25202142379
Size: 433.15 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 423 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9d0ad3d9b21b3860b9ad3a7bb7bca13e9a17fedd77101221533c30c12ae195d0
MD5
8b998e9d0303ee9340cdc25202142379
Verdict
Malicious
File type
PE Executable · 423 KB

Cite this report: https://app.malva.re/sha256/9d0ad3d9b21b3860b9ad3a7bb7bca13e9a17fedd77101221533c30c12ae195d0

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
433.15 KB · 433,152 B
First seen
2026-11-01 07:00 · 2 hours ago
Last seen
2026-11-01 07:00 · 2 hours ago
Last analysis
2026-11-01 07:00 · 2 hours ago
Hashes
MD5 8b998e9d0303ee9340cdc25202142379 Sha1 1246170bcd34513ab0ad4dc549abf5091029316b Sha256 9d0ad3d9b21b3860b9ad3a7bb7bca13e9a17fedd77101221533c30c12ae195d0 Sha384 0c503291a67c1b7cd9c6f340970749450a826252a53b0f0bcc39e3cda68d1accbf7a6e5aad2570ead570a5f67e664a38 Sha512 14dc6dc7fc03456438aea94e0efcce6f48a1125768978efbb3ded73b339de554679ca89b367ea4995dbd900eeffb5267f4760d85b7f5d7b749ca1908352fa3fd SSDeep 6144:hkTZo3+8+gGaWYFuOcCsWndcMt9Uw4CmH0In9qO8WfU:hkTZoOtgGeie7Uw4CmUILtfU TLSH 4C945B6776624F15D2841737C9CB590083EA6682A767E30FB28433952D027FFEE0B697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE8b998e9d0303ee9340cdc25202142379
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Gzisgqlk.exe
Full Name
Gzisgqlk.exe
EntryPoint
System.Void vMIRWF2lalXUquH8CM.dgkIAiirRiNT4LnVWk::oGeQe9TfI()
Scope Name
Gzisgqlk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gzisgqlk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vMIRWF2lalXUquH8CM.dgkIAiirRiNT4LnVWk::oGeQe9TfI()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: nop
nop <null>
newobj System.Void b3t0VFcyKWtMEnbdDp.Avu8mvIsSvKwn39qWV::.ctor()
ldsfld GZaeiLaY0FtBqCrw937 GZaeiLaY0FtBqCrw937::HFEa98MPmW
call System.Void GZaeiLaY0FtBqCrw937::TwhafA2O4P(System.Object,GZaeiLaY0FtBqCrw937)
ldc.i4 5
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_74ad17359ac34b7bafda424c11e9bf29
brtrue IL_0079: switch(IL_0095)
pop <null>
ldc.i4 0
br IL_0079: switch(IL_0095)
br IL_0075: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0075: ldloc V_0
br IL_0095: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_1f0b683f7ffd4ffcbefb154d0d941bab
brtrue IL_00CC: switch(IL_00E8)
pop <null>
ldc.i4 4
br IL_00CC: switch(IL_00E8)
br IL_00C8: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C8: ldloc V_2
br IL_00E8: leave IL_0135
leave IL_0135: ret
ldc.i4 2
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_adaf0c3b82724551becee9a35c3ea024
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ldsfld hSFbOSaXAyQMbTUMZXl hSFbOSaXAyQMbTUMZXl::dIla57cShg
call System.Void hSFbOSaXAyQMbTUMZXl::TwhafA2O4P(hSFbOSaXAyQMbTUMZXl)
ldc.i4 5
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_f0f4dc8f8be74980b7e543fb514c275d
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ret <null>
Module Name
Gzisgqlk.exe
Full Name
Gzisgqlk.exe
EntryPoint
System.Void vMIRWF2lalXUquH8CM.dgkIAiirRiNT4LnVWk::oGeQe9TfI()
Scope Name
Gzisgqlk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gzisgqlk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vMIRWF2lalXUquH8CM.dgkIAiirRiNT4LnVWk::oGeQe9TfI()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: nop
nop <null>
newobj System.Void b3t0VFcyKWtMEnbdDp.Avu8mvIsSvKwn39qWV::.ctor()
ldsfld GZaeiLaY0FtBqCrw937 GZaeiLaY0FtBqCrw937::HFEa98MPmW
call System.Void GZaeiLaY0FtBqCrw937::TwhafA2O4P(System.Object,GZaeiLaY0FtBqCrw937)
ldc.i4 5
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_74ad17359ac34b7bafda424c11e9bf29
brtrue IL_0079: switch(IL_0095)
pop <null>
ldc.i4 0
br IL_0079: switch(IL_0095)
br IL_0075: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0075: ldloc V_0
br IL_0095: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_1f0b683f7ffd4ffcbefb154d0d941bab
brtrue IL_00CC: switch(IL_00E8)
pop <null>
ldc.i4 4
br IL_00CC: switch(IL_00E8)
br IL_00C8: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C8: ldloc V_2
br IL_00E8: leave IL_0135
leave IL_0135: ret
ldc.i4 2
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_adaf0c3b82724551becee9a35c3ea024
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ldsfld hSFbOSaXAyQMbTUMZXl hSFbOSaXAyQMbTUMZXl::dIla57cShg
call System.Void hSFbOSaXAyQMbTUMZXl::TwhafA2O4P(hSFbOSaXAyQMbTUMZXl)
ldc.i4 5
ldsfld <Module>{5b365761-8583-4f7b-a23c-1bed03a03026} <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_dc8c44aeeba94dc58b46c703e3a27b84
ldfld System.Int32 <Module>{5b365761-8583-4f7b-a23c-1bed03a03026}::m_f0f4dc8f8be74980b7e543fb514c275d
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙