Malicious
Malicious

8e2f9df0b9bc973c62d967e8cb0eca62

Share on LinkedIn
Print
PE Executable
MD5: 8e2f9df0b9bc973c62d967e8cb0eca62
Size: 432.13 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 422 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
40fac17d25358c94d0cbaa173e4493aa8f2102ac1c639aed0597155ee0a5fed6
MD5
8e2f9df0b9bc973c62d967e8cb0eca62
Verdict
Malicious
File type
PE Executable · 422 KB

Cite this report: https://app.malva.re/sha256/40fac17d25358c94d0cbaa173e4493aa8f2102ac1c639aed0597155ee0a5fed6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
432.13 KB · 432,128 B
First seen
2026-11-01 07:00 · 2 hours ago
Last seen
2026-11-01 07:00 · 2 hours ago
Last analysis
2026-11-01 07:00 · 2 hours ago
Hashes
MD5 8e2f9df0b9bc973c62d967e8cb0eca62 Sha1 aee1472caaa954d8b185eecd0e3894d3fabc8f20 Sha256 40fac17d25358c94d0cbaa173e4493aa8f2102ac1c639aed0597155ee0a5fed6 Sha384 e64a5d3b1f582c9f19e52649849f5858a892c61ba8f96776fc723eec2be967256ba7012743f9b16e42a1ca76b0a387d6 Sha512 42cedfb75c413a784c7c85d8e84ccde4ad0bac174358a34a7c27ef4ca1e656a6136360a68150459210c970bfd8429848c465bf391f98bd2589932567f76bcf54 SSDeep 6144:yPhSWVvfELFZ+g89bXJ/M6herPm0vrM0aAWP3Pec2oA:OfnE5vMXNcmko7Auff TLSH 95945B6733524E11D1851337C0DB494083E6A6427BB7E30F768523EA1E43BEEEE4A697
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE8e2f9df0b9bc973c62d967e8cb0eca62
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Fzzlxxfx.exe
Full Name
Fzzlxxfx.exe
EntryPoint
System.Void TxriQItcxSL4JBDFmY.HHodgsjacFZsSYbQJB::l13sjrNu4()
Scope Name
Fzzlxxfx.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fzzlxxfx
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TxriQItcxSL4JBDFmY.HHodgsjacFZsSYbQJB::l13sjrNu4()
Main IL Instruction Count
65
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0108: ldsfld c4vGJGYd3NiC2okE9v4 c4vGJGYd3NiC2okE9v4::VYcYwmIuLy
ret <null>
nop <null>
ldsfld A1ooAPYyU9EBqdaO09M A1ooAPYyU9EBqdaO09M::D5BY2ikk2K
call System.Void A1ooAPYyU9EBqdaO09M::mU8YjQabkk(A1ooAPYyU9EBqdaO09M)
ldc.i4 0
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_35a16980d7184e369ee81da238cee7ae
brfalse IL_0075: switch(IL_0091)
pop <null>
ldc.i4 3
br IL_0075: switch(IL_0091)
br IL_0071: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0071: ldloc V_0
br IL_0091: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 1
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_119a1e1eca1246de9a1587b3a637c207
brtrue IL_00C8: switch(IL_00E4)
pop <null>
ldc.i4 0
br IL_00C8: switch(IL_00E4)
br IL_00C4: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00C4: ldloc V_1
br IL_00E4: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_02c102d4c4364c448bb10d31d1b77007
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0108)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0039,IL_0108)
ldsfld c4vGJGYd3NiC2okE9v4 c4vGJGYd3NiC2okE9v4::VYcYwmIuLy
call System.Void c4vGJGYd3NiC2okE9v4::mU8YjQabkk(c4vGJGYd3NiC2okE9v4)
ldc.i4 1
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_a07990a87605498b90fe5bafc8685e72
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0108)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0108)
Module Name
Fzzlxxfx.exe
Full Name
Fzzlxxfx.exe
EntryPoint
System.Void TxriQItcxSL4JBDFmY.HHodgsjacFZsSYbQJB::l13sjrNu4()
Scope Name
Fzzlxxfx.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fzzlxxfx
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TxriQItcxSL4JBDFmY.HHodgsjacFZsSYbQJB::l13sjrNu4()
Main IL Instruction Count
65
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0108: ldsfld c4vGJGYd3NiC2okE9v4 c4vGJGYd3NiC2okE9v4::VYcYwmIuLy
ret <null>
nop <null>
ldsfld A1ooAPYyU9EBqdaO09M A1ooAPYyU9EBqdaO09M::D5BY2ikk2K
call System.Void A1ooAPYyU9EBqdaO09M::mU8YjQabkk(A1ooAPYyU9EBqdaO09M)
ldc.i4 0
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_35a16980d7184e369ee81da238cee7ae
brfalse IL_0075: switch(IL_0091)
pop <null>
ldc.i4 3
br IL_0075: switch(IL_0091)
br IL_0071: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0071: ldloc V_0
br IL_0091: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 1
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_119a1e1eca1246de9a1587b3a637c207
brtrue IL_00C8: switch(IL_00E4)
pop <null>
ldc.i4 0
br IL_00C8: switch(IL_00E4)
br IL_00C4: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_00C4: ldloc V_1
br IL_00E4: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_02c102d4c4364c448bb10d31d1b77007
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0108)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0038,IL_0039,IL_0108)
ldsfld c4vGJGYd3NiC2okE9v4 c4vGJGYd3NiC2okE9v4::VYcYwmIuLy
call System.Void c4vGJGYd3NiC2okE9v4::mU8YjQabkk(c4vGJGYd3NiC2okE9v4)
ldc.i4 1
ldsfld <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e} <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_2cdba976216e4afe9a835f9f9dd76f66
ldfld System.Int32 <Module>{b8915597-4b3d-4f54-91fa-9ed596e4013e}::m_a07990a87605498b90fe5bafc8685e72
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0108)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0108)

An error has occurred. This application may no longer respond until reloaded. Reload 🗙