Suspect
a7c3ec6015767fb0aea0f127ea359aa6
PE Executable
MD5: a7c3ec6015767fb0aea0f127ea359aa6
Size: 56.83 KB
application/x-dosexec
This sample is a 55.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 1 embedded or derived file. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12
- MD5
- a7c3ec6015767fb0aea0f127ea359aa6
- Verdict
- Inconclusive
- File type
- PE Executable · 55.5 KB
Cite this report: https://app.malva.re/sha256/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
56.83 KB · 56,832 B
Hashes
MD5
a7c3ec6015767fb0aea0f127ea359aa6
Sha1
062caf584b8a381cf4af68985f2e642b1bb2a135
Sha256
f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12
Sha384
d7a073e8ff41310efa1fa78c6be4bf1f165ecaaaf6a51c9bc9922b7280a3edd24f25ab1a845b149d7ee1de7be3caea1e
Sha512
cd29222c88390be8d4829d874ec112415913addbf7e615cdcf2689b1923309381e8e9efa94cbdc5ba7ba018f2e354c5b961b07cb6bada43136de146df2c5a621
SSDeep
768:ntjr6GrIRR1Lqe6a5K5oW0Kaf34qlYAJd7JsEEaJBPPkRQ/a31W6x:tv6kGmeKarKCPFsE7VPkRQYp
TLSH
AA43DC9C765075DFC86BC872DAA81C64EA6074BB431BD243906316EDAE0D99BCF190F3
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Very high
2 files
EXEa7c3ec6015767fb0aea0f127ea359aa6
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
STICH
beta
No STICH Path has been generated for this analysis yet.
1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
1| Name | Value |
|---|---|
| Info | PDB Path: GHOSTT.pdb |
| Module Name | GHOSTT.dll |
| Full Name | GHOSTT.dll |
| Scope Name | GHOSTT.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | GHOSTT |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.5.1 |
| Total Strings | 0 |
| Main Method | Not found or no body |
| Module Name | GHOSTT.dll |
| Full Name | GHOSTT.dll |
| Scope Name | GHOSTT.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | GHOSTT |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.5.1 |
| Total Strings | 0 |
| Main Method | Not found or no body |
2 files
EXEa7c3ec6015767fb0aea0f127ea359aa6
Structure
BINResources
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules.
Create a free account