Suspicious
Suspect

aab2de28d6aa73ee0cd9253317e24165

Share on LinkedIn
Print
PE Executable
MD5: aab2de28d6aa73ee0cd9253317e24165
Size: 677.38 KB
application/x-dosexec

This sample is a 661.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 12 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
81a490067ca061d838ba79ad02b4397acbdf1e90a85a371f66ab3cda13b844a3
MD5
aab2de28d6aa73ee0cd9253317e24165
Verdict
Inconclusive
File type
PE Executable · 661.5 KB

Cite this report: https://app.malva.re/sha256/81a490067ca061d838ba79ad02b4397acbdf1e90a85a371f66ab3cda13b844a3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
677.38 KB · 677,376 B
First seen
2026-10-20 12:15 · 6 days ago
Last seen
2026-10-20 12:15 · 6 days ago
Last analysis
2026-10-20 12:15 · 6 days ago
Hashes
MD5 aab2de28d6aa73ee0cd9253317e24165 Sha1 6ca21ecdce46f2595c11f3cdde62c169ed7d8a6a Sha256 81a490067ca061d838ba79ad02b4397acbdf1e90a85a371f66ab3cda13b844a3 Sha384 3e6a1cba4fe3854522fc194d351055d2cb17266112b9e996692d00885c3ad03f5cf4d8a9b35d20fd05042dce8898f476 Sha512 d6c7bd16e6365161b7f7a884b7c9ab362c68b06d973b433bac9f06234d2e3ec918b90803d1d066e0c92b67dd83bd5b86b79bc22a3f47f6c3faf85786e337ef93 SSDeep 12288:WRl5e5ua/BOvgkEClK8KxpAkG8jF6aUvYwFzlDCbAF4S:0+ugUKxb3j9UvYw94bAm TLSH 4AE4DF102299E712D4F53BB4C561F2F55379AEC9F822E20B4EE2BDDFF875B04590A242
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

13 files
EXEaab2de28d6aa73ee0cd9253317e24165
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
Ttqr.exe
Full Name
Ttqr.exe
EntryPoint
System.Void PeatBank.Program::Main()
Scope Name
Ttqr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ttqr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void PeatBank.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PeatBank.BankForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
Ttqr.exe
Full Name
Ttqr.exe
EntryPoint
System.Void PeatBank.Program::Main()
Scope Name
Ttqr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ttqr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
341
Main Method
System.Void PeatBank.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void PeatBank.BankForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙