Malicious
Malicious

a4a2ab8a641059800db10989bee83953

PE Executable
MD5: a4a2ab8a641059800db10989bee83953
Size: 2.85 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.85 MB · 2,848,768 B
First seen
2026-07-17 05:01 · 3 months ago
Last seen
2026-07-17 05:01 · 3 months ago
Last analysis
2026-07-17 07:35 · 3 months ago
Hashes
MD5 a4a2ab8a641059800db10989bee83953 Sha1 d4abbd7a388a657a8635158d4002b42f98cabec2 Sha256 5d38468be1bebfed0309c68875e07a6d2a5d928f4117c7293f3e04c30811d361 Sha384 2f48099480e2129dc1ab410333ffd55e8e7a166bd292a750f1a14513cf28c0eda22f6c4c47481cc71c834879d7da5fff Sha512 e43491d35ecad89f2796841a5f9b7d7295071c0f5630e638dbe71ea8e6b4662ddd9a17a666d89f20fa85d84e9f1a92f132e1179e559a556b409a449457eb7bd8 SSDeep 49152:dRC5koKwWlbdvN2ZYMmje/UxlpvbR89//JpM09Qg/r8CXY6yNl2tai5u1K7U+Ho5:7RdvNoWmcqM09tj3I6yri5u+v TLSH 4ED53385CA97C900CA55273699E6E3314370CFC9F123E62B16EE4FCB79337A99E51241
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL UPolyX 0.3 -> delikon
Symbol obfuscation
Medium
1 malicious · 23 files
EXEa4a2ab8a641059800db10989bee83953
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINdlE.tlG.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINMR5
DATA[NBF]root.Data
BINDlr.Gl4.resources
BINZBtg.g.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINGalacticEmpire4X.Properties.Resources.resources
BINZmKy
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Info
PDB Path: ZBtg.pdb
Module Name
ZBtg.exe
Full Name
ZBtg.exe
EntryPoint
System.Void Iq.R8::UF()
Scope Name
ZBtg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZBtg
Assembly Version
4.2.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
69
Main Method
System.Void Iq.R8::UF()
Main IL Instruction Count
16
Main IL 
br IL_0015: nop
nop <null>
newobj System.Void dlE.tlG::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_002A: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002C: nop
call System.Void ydb.Wdq::WMu()
br IL_0005: nop
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0020: call System.Void ydb.Wdq::WMu()
Module Name
ZBtg.exe
Full Name
ZBtg.exe
EntryPoint
System.Void Iq.R8::UF()
Scope Name
ZBtg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ZBtg
Assembly Version
4.2.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
69
Main Method
System.Void Iq.R8::UF()
Main IL Instruction Count
16
Main IL 
br IL_0015: nop
nop <null>
newobj System.Void dlE.tlG::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_002A: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002C: nop
call System.Void ydb.Wdq::WMu()
br IL_0005: nop
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0020: call System.Void ydb.Wdq::WMu()
1 malicious · 23 files
EXEa4a2ab8a641059800db10989bee83953
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙