Malicious
Malicious

c54a0857fe11672527a2343ad99a2468

PE Executable
MD5: c54a0857fe11672527a2343ad99a2468
Size: 1.19 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.19 MB · 1,189,376 B
First seen
2026-10-19 08:15 · 6 days ago
Last seen
2026-10-19 08:15 · 6 days ago
Last analysis
2026-10-19 16:18 · 6 days ago
Hashes
MD5 c54a0857fe11672527a2343ad99a2468 Sha1 6b06fe78f692706767490ce72f20c70a786684b7 Sha256 6e085dc4297fc566c8749293f56dd6d81b764bda9f42ce1fc07af22ba8309444 Sha384 6e592f910690710d5d67eb95ed4c291293c0173f40b3a91b900816288d3c242e1990bd10ec616f66b3c0c882fd108401 Sha512 e82cb0ee115996467c6e3547b6bcd36305c121bde6e3e6a14b8804883fa46d3e30f34369878a375aaa8407788d28c3fb76b71403c33a8f75c4cfcf1a81a71686 SSDeep 24576:2sGqj0qdPBRkuRZOs/qNHemCdMcmtNk/YwT/XfS5OncZb7MPpOZrW:2SjRfRZOvFFCdbSU/v+24bIOZW TLSH CD4501656723D402CA51933145E2F6B803B85F9AF413D31BAEE8BEDB7629F160D84783
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 42 files
EXEc54a0857fe11672527a2343ad99a2468
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINvu.Dx.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINNLR.TLb.resources
BINNJ
DATA[NBF]root.Data
BINCel.beN.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINQQC.Properties.Resources.resources
BINh17 (5)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINh17 (4)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa4
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINh21
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa9 (7)
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINa9 (2)
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINtcVU
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>img>img
Shape pe:exe>img>img
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Name Value
Module Name
tNPh.exe
Full Name
tNPh.exe
EntryPoint
System.Void xGU.DGY::rGk()
Scope Name
tNPh.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tNPh
Assembly Version
5.3.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Info
PDB Path: tNPh.pdb
Total Strings
434
Main Method
System.Void xGU.DGY::rGk()
Main IL Instruction Count
12
Main IL 
br IL_001B: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ret <null>
call System.Void cgc.ggB::YlH()
br IL_0025: newobj System.Void NLR.TLb::.ctor()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0006: call System.Void cgc.ggB::YlH()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0010: ldc.i4.0
newobj System.Void NLR.TLb::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: ret
Module Name
tNPh.exe
Full Name
tNPh.exe
EntryPoint
System.Void xGU.DGY::rGk()
Scope Name
tNPh.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tNPh
Assembly Version
5.3.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
434
Main Method
System.Void xGU.DGY::rGk()
Main IL Instruction Count
12
Main IL 
br IL_001B: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ret <null>
call System.Void cgc.ggB::YlH()
br IL_0025: newobj System.Void NLR.TLb::.ctor()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0006: call System.Void cgc.ggB::YlH()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0010: ldc.i4.0
newobj System.Void NLR.TLb::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: ret
1 malicious · 42 files
EXEc54a0857fe11672527a2343ad99a2468
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙