Malicious
Malicious

ba6c438d1bbff1ff6de83a0fcaca9350

PE Executable
MD5: ba6c438d1bbff1ff6de83a0fcaca9350
Size: 1.14 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.14 MB · 1,143,808 B
First seen
2026-09-10 11:15 · one month ago
Last seen
2026-09-10 11:15 · one month ago
Last analysis
2026-09-10 11:16 · one month ago
Hashes
MD5 ba6c438d1bbff1ff6de83a0fcaca9350 Sha1 30eda45e93b54a28552ab355414a4dc1b887675d Sha256 eed61761454ec6512cea73d5c13430aea0d66a8518970775dd31c8b0fd677bd6 Sha384 f2fa6d667577a761398fe576adacd6a001c18879588265a408e90520ecdd0df39089d41494d56fa9af06cd0cbaefda95 Sha512 8ffcf13de0297a470749e14f32c40cfd6f8099a9f7124d832ee2c94b044f8a41468969ce83ea8900dd082e3fff8fb660544f07dfcbd8de3a38cd4ad386cbdcd9 SSDeep 24576:K/jP/2oSdv/Z/NHHW7s9PcZ571X4jzUNeIha7qR4OcLl/JZi6jy:K/b/2oSVes9EZ56nU8I47DDZiU TLSH DE3502182227DD01E1D65BB819F0E7B415B48F84E922C343DEFA7DABB93A35A3D412D1
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 24 files
EXEba6c438d1bbff1ff6de83a0fcaca9350
Structure
BIN.Net Resources
BINLmS.nmb.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINPro
DATA[NBF]root.Data
BINbackgroundWorker1.TrayLocation
BINWmv.em2.resources
BINImd.XmK.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINNeuralLinkDataMiner.Properties.Resources.resources
BINlqnp
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Module Name
GUhE.exe
Full Name
GUhE.exe
EntryPoint
System.Void tb.mH::JS()
Scope Name
GUhE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GUhE
Assembly Version
8.6.4.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
149
Main Method
System.Void tb.mH::JS()
Main IL Instruction Count
16
Main IL 
br IL_0023: nop
nop <null>
newobj System.Void LmS.nmb::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0015: nop
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_002E: call System.Void UqG.oql::yZK()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0017: nop
call System.Void UqG.oql::yZK()
br IL_0005: nop
Info
PDB Path: GUhE.pdb
Module Name
GUhE.exe
Full Name
GUhE.exe
EntryPoint
System.Void tb.mH::JS()
Scope Name
GUhE.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GUhE
Assembly Version
8.6.4.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
149
Main Method
System.Void tb.mH::JS()
Main IL Instruction Count
16
Main IL 
br IL_0023: nop
nop <null>
newobj System.Void LmS.nmb::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0015: nop
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_002E: call System.Void UqG.oql::yZK()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0017: nop
call System.Void UqG.oql::yZK()
br IL_0005: nop
1 malicious · 24 files
EXEba6c438d1bbff1ff6de83a0fcaca9350
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙