Suspicious
Suspect

PE Executable
MD5: c157b825a19e77893b8ebe6d43e1165d
Size: 1.02 MB
application/x-dosexec

This sample is a 1000 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 58 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
738480ab58300675f57080ee683e73d854f5f3ed01cd846c2b0e98116a0d301f
MD5
c157b825a19e77893b8ebe6d43e1165d
Verdict
Inconclusive
File type
PE Executable · 1000 KB

Cite this report: https://app.malva.re/sha256/738480ab58300675f57080ee683e73d854f5f3ed01cd846c2b0e98116a0d301f

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
1.02 MB · 1,024,000 B
First seen
2025-12-11 16:15 · 11 months ago
Last seen
2025-12-11 16:15 · 11 months ago
Last analysis
2025-12-11 16:27 · 11 months ago
Hashes
MD5 c157b825a19e77893b8ebe6d43e1165d Sha1 b48b58269e743b7d9ce1b66ee6c55ee18da7beb8 Sha256 738480ab58300675f57080ee683e73d854f5f3ed01cd846c2b0e98116a0d301f Sha384 506fdeae72e6d53a94d06ffc9cc3bd6bbc3ee4e24bd3284f1429f9e3bfb1d681678fe22c9d2ea806c2c06ef5aff17d81 Sha512 17c0a797fc32f7771e3bfc694dbc83f0c8a0c52087666871fe2228de46cd02db9d1152714218ca08c25693040439c492465865403e67d7b3af9f0d93af058f29 SSDeep 24576:snOl0VmLLdufPNxPb+cUxifkn69DF2CyM:gLmEdxPhX8sJ TLSH C325BE011BE94F98F1BF8734A935051447F6FC03CE36DB9E299868ED2972B91AA51333
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

59 files
EXEc157b825a19e77893b8ebe6d43e1165d
Structure
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINPobregas.67594
BINax3BjQ.Resources.resources
BINe42b56b2d98c4d.Resources.resources
BIN51cf908b0
DATA[NBF]root.Data
BIN51cf908b1
DATA[NBF]root.Data
BIN51cf908b10
DATA[NBF]root.Data
BIN51cf908b11
DATA[NBF]root.Data
BIN51cf908b12
DATA[NBF]root.Data
BIN51cf908b13
DATA[NBF]root.Data
BIN51cf908b14
DATA[NBF]root.Data
BIN51cf908b15
DATA[NBF]root.Data
BIN51cf908b16
DATA[NBF]root.Data
BIN51cf908b17
DATA[NBF]root.Data
BIN51cf908b18
DATA[NBF]root.Data
BIN51cf908b19
DATA[NBF]root.Data
BIN51cf908b2
DATA[NBF]root.Data
BIN51cf908b20
DATA[NBF]root.Data
BIN51cf908b21
DATA[NBF]root.Data
BIN51cf908b22
DATA[NBF]root.Data
BIN51cf908b23
DATA[NBF]root.Data
BIN51cf908b24
DATA[NBF]root.Data
BIN51cf908b25
DATA[NBF]root.Data
BIN51cf908b3
DATA[NBF]root.Data
BIN51cf908b4
DATA[NBF]root.Data
BIN51cf908b5
DATA[NBF]root.Data
BIN51cf908b6
DATA[NBF]root.Data
BIN51cf908b7
DATA[NBF]root.Data
BIN51cf908b8
DATA[NBF]root.Data
BIN51cf908b9
DATA[NBF]root.Data

Name Value
Module Name
ax3BjQ
Full Name
ax3BjQ
EntryPoint
System.Void ax3BjQ.cp4JZ1fbac5B::zp4PDxt()
Scope Name
ax3BjQ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ax3BjQ
Assembly Version
22.11.22.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void ax3BjQ.cp4JZ1fbac5B::zp4PDxt()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void ax3BjQ.2jiAroK/ga0SfTb1mt.ry1T7yWas::5gwGjK2mJ(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>
Module Name
ax3BjQ
Full Name
ax3BjQ
EntryPoint
System.Void ax3BjQ.cp4JZ1fbac5B::zp4PDxt()
Scope Name
ax3BjQ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ax3BjQ
Assembly Version
22.11.22.13
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1427
Main Method
System.Void ax3BjQ.cp4JZ1fbac5B::zp4PDxt()
Main IL Instruction Count
24
Main IL 
nop <null>
ldstr BackgroundService
stloc.0 <null>
ldc.i4 70193
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.s 50
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldstr 67594
call System.Void ax3BjQ.2jiAroK/ga0SfTb1mt.ry1T7yWas::5gwGjK2mJ(System.String)
nop <null>
leave.s IL_003D: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_003D: nop
nop <null>
ret <null>

59 files
EXEc157b825a19e77893b8ebe6d43e1165d
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙