Suspicious
Suspect

8f95681ac973147a8932f63b11c4c0fb

Share on LinkedIn
Print
PE Executable
MD5: 8f95681ac973147a8932f63b11c4c0fb
Size: 576 KB
application/x-dosexec

This sample is a 562.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 48 embedded or derived files. It matches 21 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10
MD5
8f95681ac973147a8932f63b11c4c0fb
Verdict
Inconclusive
File type
PE Executable · 562.5 KB

Cite this report: https://app.malva.re/sha256/55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
576 KB · 576,000 B
First seen
2026-10-13 16:15 · 17 days ago
Last seen
2026-10-13 16:15 · 17 days ago
Last analysis
2026-10-13 16:15 · 17 days ago
Hashes
MD5 8f95681ac973147a8932f63b11c4c0fb Sha1 43e4f4da3960277c8ed8d9aeb6a5f2ec258ef563 Sha256 55249a75e9ae5d378fbb24422a200bcfb68d23e4194418647d54ef956b2ffc10 Sha384 c37901e587bcc229d14496030e31381f49a1d0c72a4ab3739aa7a320cd12cc5a6c9afaab03263fa6daa669d583c98e71 Sha512 8cd3acb5058a27558c013815fc28f9d097550599fb4ca3dfc6aec0703087c0e56de2352e1a298e75fd5f6f400bf5c77d5cc8f74a948653db2b79981ad0c65c24 SSDeep 12288:JCP49xsCP49xV0B3MOiP9/JvpOjxU6vQMSJDWpXNmnHrrpKXIhLO14stRPw9x:5969PW3MbPzvpOjxV8WfmHrAXIn9 TLSH 6AC412943BC403AEF9F18FB299F75313273A6F89C4B98B5F45A03B182579B51C2D2A41
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

49 files
EXE8f95681ac973147a8932f63b11c4c0fb
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

11 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 9img 2

Name Value
Module Name
Steam.exe
Full Name
Steam.exe
EntryPoint
System.Void Steams.App::Main()
Scope Name
Steam.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steam
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
161
Main Method
System.Void Steams.App::Main()
Main IL Instruction Count
6
Main IL 
newobj System.Void Steams.App::.ctor()
dup <null>
callvirt System.Void Steams.App::InitializeComponent()
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
ret <null>
Info 
PDB Path: C:\Users\google\Desktop\Random file\??????????????\??????????\SteamSetup\Steams\obj\Release\Steam.pdb
Module Name
Steam.exe
Full Name
Steam.exe
EntryPoint
System.Void Steams.App::Main()
Scope Name
Steam.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Steam
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
161
Main Method
System.Void Steams.App::Main()
Main IL Instruction Count
6
Main IL 
newobj System.Void Steams.App::.ctor()
dup <null>
callvirt System.Void Steams.App::InitializeComponent()
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙