Sign up free
Suspicious
Suspect

9ec8a802fe2a11b72b83fa027fb651ed

Share on LinkedIn
Print
PE Executable
MD5: 9ec8a802fe2a11b72b83fa027fb651ed
Size: 1.11 MB
application/x-dosexec

This sample is a 1.1 MB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 14 embedded or derived files. It matches 8 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
ed0f1d1b4673e50dfda972458c7a37b3291086e4f3d72a4464ac92b16b524cf3
MD5
9ec8a802fe2a11b72b83fa027fb651ed
Verdict
No known threat found
File type
PE Executable · 1.1 MB

Cite this report: https://app.malva.re/sha256/ed0f1d1b4673e50dfda972458c7a37b3291086e4f3d72a4464ac92b16b524cf3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.11 MB · 1,114,624 B
First seen
2026-11-04 08:00 · 2 hours ago
Last seen
2026-11-04 08:00 · 2 hours ago
Last analysis
2026-11-04 08:00 · 2 hours ago
Hashes
MD5 9ec8a802fe2a11b72b83fa027fb651ed Sha1 fc065d658c65adbdbe400f05342bea466853969f Sha256 ed0f1d1b4673e50dfda972458c7a37b3291086e4f3d72a4464ac92b16b524cf3 Sha384 53724663bddc39988c385b372f4d83d689cfcdacff26db1350ac758f2c6741da17fcbdca254ad1b317e513cff4a1147f Sha512 70eab715adf0530b8b77bce1a03d9a8d9b3fa127429fd05cc1169f77ead72132799d62630041bdc02e473fda32278140da9f520ffc36a2c9875e0b931fc8d5c0 SSDeep 24576:/oWX9lcaF9cmxK/1fgX/f/qO8LV3hgSTeoH7NSTd:/Rlca4g8J83/ElhgSbq TLSH 11356B58355CF9CEC4128D77C96C9CB4A5222C66D307D203B3A73D9BB92CE969E103DA
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High

15 files
EXE9ec8a802fe2a11b72b83fa027fb651ed
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
tHUv.exe
Full Name
tHUv.exe
EntryPoint
System.Void ClipperTea.Program::Main()
Scope Name
tHUv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tHUv
Assembly Version
2.50.20.50
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void ClipperTea.Program::Main()
Main IL Instruction Count
39
Main IL 
nop <null>
call System.Void ClipperTea.Program::‭‮‌‬‪​‬‍‫‮‌‍​‬‫‬​‎​‪‏‫‮()
nop <null>
ldc.i4 -817474545
ldc.i4 -1504365986
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_007A: ldsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
ldc.i4.0 <null>
call System.Void ClipperTea.Program::‌‎‍‮‌‬‫‌‬‭‫‮‮‭‌‍‪‎‍‮‌‭‎‎‎‎‫‪‌​‏‭‫‮(System.Boolean)
nop <null>
ldloc.0 <null>
ldc.i4 827011705
mul <null>
ldc.i4 1702115456
xor <null>
br.s IL_000C: ldc.i4 -1504365986
newobj System.Void ClipperTea.Model.SaphinaNavis::.ctor()
stsfld ClipperTea.Model.SaphinaNavis ClipperTea.Program::Saphina
newobj System.Void ClipperTea.Model.PassagiumPlanum::.ctor()
stsfld ClipperTea.Model.PassagiumPlanum ClipperTea.Program::Planum
newobj System.Void ClipperTea.Model.CursusDiarium::.ctor()
stsfld ClipperTea.Model.CursusDiarium ClipperTea.Program::Diarium
newobj System.Void ClipperTea.Forms.OceanForm::.ctor()
stsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
ldloc.0 <null>
ldc.i4 766490881
mul <null>
ldc.i4 175798421
xor <null>
br.s IL_000C: ldc.i4 -1504365986
ldsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
call System.Void ClipperTea.Program::‮‭‭‭‬​‌​‏‬‍‫‭‎‌‌‭‭‮‌‎‌‎‮(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
tHUv.exe
Full Name
tHUv.exe
EntryPoint
System.Void ClipperTea.Program::Main()
Scope Name
tHUv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tHUv
Assembly Version
2.50.20.50
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
0
Main Method
System.Void ClipperTea.Program::Main()
Main IL Instruction Count
39
Main IL 
nop <null>
call System.Void ClipperTea.Program::‭‮‌‬‪​‬‍‫‮‌‍​‬‫‬​‎​‪‏‫‮()
nop <null>
ldc.i4 -817474545
ldc.i4 -1504365986
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_007A: ldsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
ldc.i4.0 <null>
call System.Void ClipperTea.Program::‌‎‍‮‌‬‫‌‬‭‫‮‮‭‌‍‪‎‍‮‌‭‎‎‎‎‫‪‌​‏‭‫‮(System.Boolean)
nop <null>
ldloc.0 <null>
ldc.i4 827011705
mul <null>
ldc.i4 1702115456
xor <null>
br.s IL_000C: ldc.i4 -1504365986
newobj System.Void ClipperTea.Model.SaphinaNavis::.ctor()
stsfld ClipperTea.Model.SaphinaNavis ClipperTea.Program::Saphina
newobj System.Void ClipperTea.Model.PassagiumPlanum::.ctor()
stsfld ClipperTea.Model.PassagiumPlanum ClipperTea.Program::Planum
newobj System.Void ClipperTea.Model.CursusDiarium::.ctor()
stsfld ClipperTea.Model.CursusDiarium ClipperTea.Program::Diarium
newobj System.Void ClipperTea.Forms.OceanForm::.ctor()
stsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
ldloc.0 <null>
ldc.i4 766490881
mul <null>
ldc.i4 175798421
xor <null>
br.s IL_000C: ldc.i4 -1504365986
ldsfld ClipperTea.Forms.OceanForm ClipperTea.Program::FormOcean
call System.Void ClipperTea.Program::‮‭‭‭‬​‌​‏‬‍‫‭‎‌‌‭‭‮‌‎‌‎‮(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙