Suspicious
Suspect

8f95681ac973147a8932f63b11c4c0fb

PE Executable
MD5: 8f95681ac973147a8932f63b11c4c0fb
Size: 576 KB
application/x-dosexec

This sample is a 562.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 48 embedded or derived files. It matches 21 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10
MD5
8f95681ac973147a8932f63b11c4c0fb
Verdict
Inconclusive
File type
PE Executable · 562.5 KB

Cite this report: https://app.malva.re/sha256/55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
576 KB · 576,000 B
First seen
2026-10-13 16:15 · 17 days ago
Last seen
2026-10-13 16:15 · 17 days ago
Last analysis
2026-10-13 16:15 · 17 days ago
Hashes
MD5 8f95681ac973147a8932f63b11c4c0fb Sha1 43e4f4da3960277c8ed8d9aeb6a5f2ec258ef563 Sha256 55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10 Sha384 c37901e587bcc229d14496030e31381f49a1d0c72a4ab3739aa7a320cd12cc5a6c9afaab03263fa6daa669d583c98e71 Sha512 8cd3acb5058a27558c013815fc28f9d097550599fb4ca3dfc6aec0703087c0e56de2352e1a298e75fd5f6f400bf5c77d5cc8f74a948653db2b79981ad0c65c24 SSDeep 12288:JCP49xsCP49xV0B3MOiP9/JvpOjxU6vQMSJDWpXNmnHrrpKXIhLO14stRPw9x:5969PW3MbPzvpOjxV8WfmHrAXIn9 TLSH 6AC412943BC403AEF9F18FB299F75313273A6F89C4B98B5F45A03B182579B51C2D2A41
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

49 files
EXE8f95681ac973147a8932f63b11c4c0fb
Structure
BIN.Net Resources
BINSteam.g.resources
BINSteam.Form1.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINSteam.Properties.Resources.resources
EXESteamInstall
Structure
BIN.Net Resources
BINSteamInstall.Properties.Resources.resources
BINResources
BINRT_VERSION
BINID:0001
BINID:0
ZIPruntimes
BINwin-arm64
BINnative
DLLWebView2Loader.dll
Structure
P7B[Authenticode]_4f68f2be.p7b
BINwin-x64
BINnative
DLLWebView2Loader.dll
Structure
P7B[Authenticode]_ef32f520.p7b
BINwin-x86
BINnative
DLLWebView2Loader.dll
Structure
P7B[Authenticode]_2d079827.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINsss
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcostura.costura.dll.compressed
DLLcostura.costura.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.microsoft.web.webview2.core.dll.compressed
DLLcostura.microsoft.web.webview2.core.dll
Structure
P7B[Authenticode]_a8f07653.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.web.webview2.winforms.dll.compressed
DLLcostura.microsoft.web.webview2.winforms.dll
Structure
BIN.Net Resources
BMPMicrosoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
P7B[Authenticode]_59faf3e8.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.microsoft.web.webview2.wpf.dll.compressed
DLLcostura.microsoft.web.webview2.wpf.dll
Structure
BIN.Net Resources
BINMicrosoft.Web.WebView2.Wpf.g.resources
P7B[Authenticode]_088fb798.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

11 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 9img 2

Name Value
Module Name
Steam.exe
Full Name
Steam.exe
EntryPoint
System.Void Steams.App::Main()
Scope Name
Steam.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steam
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
161
Main Method
System.Void Steams.App::Main()
Main IL Instruction Count
6
Main IL 
newobj System.Void Steams.App::.ctor()
dup <null>
callvirt System.Void Steams.App::InitializeComponent()
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
ret <null>
Info 
PDB Path: C:\Users\google\Desktop\Random file\??????????????\??????????\SteamSetup\Steams\obj\Release\Steam.pdb
Module Name
Steam.exe
Full Name
Steam.exe
EntryPoint
System.Void Steams.App::Main()
Scope Name
Steam.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steam
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
161
Main Method
System.Void Steams.App::Main()
Main IL Instruction Count
6
Main IL 
newobj System.Void Steams.App::.ctor()
dup <null>
callvirt System.Void Steams.App::InitializeComponent()
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
ret <null>

49 files
EXE8f95681ac973147a8932f63b11c4c0fb
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙