Suspicious
Suspect

a77368c5258b9aef928dcc27fb2c26a4

Share on LinkedIn
Print
PE Executable
MD5: a77368c5258b9aef928dcc27fb2c26a4
Size: 19.31 MB
application/x-dosexec

This sample is a 18.4 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 6 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bf3714398b7b46038bddff63a67d7c3ad2aabc1b996ec156d7ec335937f80c53
MD5
a77368c5258b9aef928dcc27fb2c26a4
Verdict
Inconclusive
File type
PE Executable · 18.4 MB

Cite this report: https://app.malva.re/sha256/bf3714398b7b46038bddff63a67d7c3ad2aabc1b996ec156d7ec335937f80c53

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
19.31 MB · 19,312,640 B
First seen
2026-10-25 10:00 · 5 days ago
Last seen
2026-10-25 10:00 · 5 days ago
Last analysis
2026-10-25 10:00 · 5 days ago
Hashes
MD5 a77368c5258b9aef928dcc27fb2c26a4 Sha1 2642793ff2d309549f221170a975eceeb1d53143 Sha256 bf3714398b7b46038bddff63a67d7c3ad2aabc1b996ec156d7ec335937f80c53 Sha384 0a3b7b824fb3155c99b975d40898cab61a1433fdcbd2d61d376d07fc6bbd7798ef5ed8b6cc63fbd2f86bffd563a2a9b4 Sha512 0f0721dac9c865c6c5d3e4779dc846095aa98ac70f97ff911e2175c6baa5d1b7473bc84635ba4197f475c7c00f9e9e97d54d484d78af81a05771b841e34ab5d0 SSDeep 393216:mnBE6vz4BjWF5G1SQaWeqtcnP553raaJPzA9Y2gHYOUeD:4Sq4BjWnPQaWbenD3raqPzA9Y2Lhc TLSH 891733496D209CAFD463B431DF49906118AAFD661C0BA418CE2F3F16F59F09FACB9487
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

7 files
EXEa77368c5258b9aef928dcc27fb2c26a4
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Module Name
NuxdCheat.exe
Full Name
NuxdCheat.exe
EntryPoint 
System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::Main()
Scope Name
NuxdCheat.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NuxdCheat
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method 
System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::Main()
Main IL Instruction Count
141
Main IL 
ldstr SQQW8gyU0MNoJq8vX4UT3tSU42rJ+tORt4D4p0bZf7kq/A9huywgxP7QrRCNgAgb9QB60HfnY0m/JSJK5CJTR4C57CpSSDFf8aGT8WvO/7R545x4GHkHBso5xI8xBL2HwAHhntJT1BBV6rVBuG80EEj1GB2qxjlCNV8G5R5GCMI5lo9H8M8LCnDfIqoqj6kRw/6u7QxQbtSEnR1U6pzcABpR84ymAKdOCIBH8Np7zAexFGMsA/vLrN/8cr3cVg77pdzbEcbzyeKls2aJUEgK8x3FIdov82SqSfH8IWaiuazIEwPLshB1IRCjniBZg/cHX1KboNP6EETKE/O6QB5Ve+q1qAbsfpxypaboutTMdAPQTMEQ4k7O1GVbBHQqizCGtt2PJFT3XqZ7Ws49MWhYrQ==
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::jcjdxhcwvf(System.String)
ldc.i4.3 <null>
newarr System.String[]
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldstr +ilx5964x8Csf8kSukeKfw==
stelem.ref <null>
ldloc.s V_5
ldc.i4.1 <null>
ldstr Dosfg642LwYxwmSvEI7cCA==
stelem.ref <null>
ldloc.s V_5
ldc.i4.2 <null>
ldstr tilblmhbtggbsbji
stelem.ref <null>
ldloc.s V_5
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.1 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_6
ldloc.s V_6
ldc.i4.0 <null>
ldstr YvvxdFi9IlDYwx2c+hoeKauplwIviKCDAHK0TPIED28=
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
ldstr 1L8TdAuu7lxrACDLA4teSQ==
stelem.ref <null>
ldloc.s V_6
ldc.i4.2 <null>
ldstr wydgtmrdxysrnfqc
stelem.ref <null>
ldloc.s V_6
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_6
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldstr M96k2VpxbVPTsZ7EL+Bxug==
stelem.ref <null>
ldloc.s V_7
ldc.i4.1 <null>
ldstr rZ/WxTLWMa5LqYPKwaFd/Q==
stelem.ref <null>
ldloc.s V_7
ldc.i4.2 <null>
ldstr wqjcghqvipggdpqg
stelem.ref <null>
ldloc.s V_7
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_7
stelem.ref <null>
ldloc.s V_4
stloc.0 <null>
ldstr hqramjrhhwevytiv
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly)
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_013C: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr YvvxdFi9IlDYwx2c+hoeKauplwIviKCDAHK0TPIED28=
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: call System.String System.IO.Directory::GetCurrentDirectory()
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.String System.Environment::GetEnvironmentVariable(System.String)
br.s IL_00EB: ldloc.0
call System.String System.IO.Directory::GetCurrentDirectory()
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Resources.ResourceManager::GetObject(System.String)
castclass System.Byte[]
call System.Byte[] uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::nhvsyzjfgtaqlemkrlupgeptljlskptmbuxbya(System.Byte[])
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
ldstr DolaCYMYAEjT3lusppR5Aw==
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0138: ldloc.2
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.3 <null>
blt.s IL_00C4: ldloc.0
ret <null>
Module Name
NuxdCheat.exe
Full Name
NuxdCheat.exe
EntryPoint 
System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::Main()
Scope Name
NuxdCheat.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NuxdCheat
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method 
System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::Main()
Main IL Instruction Count
141
Main IL 
ldstr SQQW8gyU0MNoJq8vX4UT3tSU42rJ+tORt4D4p0bZf7kq/A9huywgxP7QrRCNgAgb9QB60HfnY0m/JSJK5CJTR4C57CpSSDFf8aGT8WvO/7R545x4GHkHBso5xI8xBL2HwAHhntJT1BBV6rVBuG80EEj1GB2qxjlCNV8G5R5GCMI5lo9H8M8LCnDfIqoqj6kRw/6u7QxQbtSEnR1U6pzcABpR84ymAKdOCIBH8Np7zAexFGMsA/vLrN/8cr3cVg77pdzbEcbzyeKls2aJUEgK8x3FIdov82SqSfH8IWaiuazIEwPLshB1IRCjniBZg/cHX1KboNP6EETKE/O6QB5Ve+q1qAbsfpxypaboutTMdAPQTMEQ4k7O1GVbBHQqizCGtt2PJFT3XqZ7Ws49MWhYrQ==
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.Void uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::jcjdxhcwvf(System.String)
ldc.i4.3 <null>
newarr System.String[]
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ldstr +ilx5964x8Csf8kSukeKfw==
stelem.ref <null>
ldloc.s V_5
ldc.i4.1 <null>
ldstr Dosfg642LwYxwmSvEI7cCA==
stelem.ref <null>
ldloc.s V_5
ldc.i4.2 <null>
ldstr tilblmhbtggbsbji
stelem.ref <null>
ldloc.s V_5
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.1 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_6
ldloc.s V_6
ldc.i4.0 <null>
ldstr YvvxdFi9IlDYwx2c+hoeKauplwIviKCDAHK0TPIED28=
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
ldstr 1L8TdAuu7lxrACDLA4teSQ==
stelem.ref <null>
ldloc.s V_6
ldc.i4.2 <null>
ldstr wydgtmrdxysrnfqc
stelem.ref <null>
ldloc.s V_6
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_6
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldc.i4.4 <null>
newarr System.String
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldstr M96k2VpxbVPTsZ7EL+Bxug==
stelem.ref <null>
ldloc.s V_7
ldc.i4.1 <null>
ldstr rZ/WxTLWMa5LqYPKwaFd/Q==
stelem.ref <null>
ldloc.s V_7
ldc.i4.2 <null>
ldstr wqjcghqvipggdpqg
stelem.ref <null>
ldloc.s V_7
ldc.i4.3 <null>
ldstr DolaCYMYAEjT3lusppR5Aw==
stelem.ref <null>
ldloc.s V_7
stelem.ref <null>
ldloc.s V_4
stloc.0 <null>
ldstr hqramjrhhwevytiv
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly)
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_013C: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr YvvxdFi9IlDYwx2c+hoeKauplwIviKCDAHK0TPIED28=
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: call System.String System.IO.Directory::GetCurrentDirectory()
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.String System.Environment::GetEnvironmentVariable(System.String)
br.s IL_00EB: ldloc.0
call System.String System.IO.Directory::GetCurrentDirectory()
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.3 <null>
ldloc.1 <null>
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Resources.ResourceManager::GetObject(System.String)
castclass System.Byte[]
call System.Byte[] uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::nhvsyzjfgtaqlemkrlupgeptljlskptmbuxbya(System.Byte[])
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.0 <null>
ldloc.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
ldstr DolaCYMYAEjT3lusppR5Aw==
call System.String uzcdekditmczggbanhfiwfuqteqwejezxht.uzcdekditmczggbanhfiwfuqteqwejezxht::daacdmcgbdpisibmibbmgc(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0138: ldloc.2
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.3 <null>
blt.s IL_00C4: ldloc.0
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙