Malicious
Malicious

c81303a3e68fe520cd9ec146d1e158ef

PE Executable
MD5: c81303a3e68fe520cd9ec146d1e158ef
Size: 446.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 436 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
91ca4a96289fae34fb441a41d836e9a61ba8d2cfe6a12a8d345c521a4ddeebd3
MD5
c81303a3e68fe520cd9ec146d1e158ef
Verdict
Malicious
File type
PE Executable · 436 KB

Cite this report: https://app.malva.re/sha256/91ca4a96289fae34fb441a41d836e9a61ba8d2cfe6a12a8d345c521a4ddeebd3

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
446.46 KB · 446,464 B
First seen
2026-11-01 11:15 · 2 days ago
Last seen
2026-11-01 11:15 · 2 days ago
Last analysis
2026-11-01 11:15 · 2 days ago
Hashes
MD5 c81303a3e68fe520cd9ec146d1e158ef Sha1 43a49dd4ff1897e3b08494011aa33ba5dfcdcea9 Sha256 91ca4a96289fae34fb441a41d836e9a61ba8d2cfe6a12a8d345c521a4ddeebd3 Sha384 34970bbb0a2e95942d3536328af25689fb93534d20f3a2f71e35bcaa007b35a3d833c0448916b6ded9d8ddd48783c474 Sha512 25e1326476f58b0524f80bc4fb4b28c0a282b6042fb8260e1ce99cf58b31f1e228b486f6689dc35bf26648d366a5ec441e6af84b458ca7ecacef04fd17d54f0d SSDeep 6144:VRkjEnW01i5HiZ1v6QaAbBcEcvMNHh+ueoWG390zm:+4m8P6UbBDGueHGt0S TLSH 99943B1B3B924E21C2994732D1D7901083E9958376FBE32B3585139E1A473FEEA0B797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXEc81303a3e68fe520cd9ec146d1e158ef
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BIN7opWA0ED8n4DCnc399.6YdCre8qdknlKyxguG
BIN7s0KXZvZBWYKJXXwvp.ps8S2lsEjD6yXT1EGr
BINMyxbsYYYRRWPDIJdGj.celjYBuGoMT31bURXA
BINQhbYC0tY1j7iXrkOCo.LsNevArVcODOceeg9c
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Tryxss.exe
Full Name
Tryxss.exe
EntryPoint
System.Void ObjK0OllbdScu2v6KU.REfOmLgwqrn6Cwq0rP::QbUTmooyC()
Scope Name
Tryxss.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tryxss
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ObjK0OllbdScu2v6KU.REfOmLgwqrn6Cwq0rP::QbUTmooyC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ret
ret <null>
nop <null>
ldsfld CBM1Qrgy4V8eNxidu0G CBM1Qrgy4V8eNxidu0G::yEegIcc534
call System.Byte[] CBM1Qrgy4V8eNxidu0G::yjIg3cEcbp(CBM1Qrgy4V8eNxidu0G)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_622ce3b26e9747ee9be6169283ad9ab2
brtrue IL_0077: switch(IL_0097,IL_0118)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0118)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0118: leave IL_0038
ldc.i4 -2072108864
ldc.i4 4
shl <null>
ldc.i4 852562046
xor <null>
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_5c982373e4b74d049464d12c62fd7d91
xor <null>
ldsfld fHAvpcg7OK4qgpojvjN fHAvpcg7OK4qgpojvjN::Ob4gpJs6eh
call System.String fHAvpcg7OK4qgpojvjN::yjIg3cEcbp(System.Int32,fHAvpcg7OK4qgpojvjN)
ldc.i4 -1321904843
ldc.i4 1
shr <null>
ldc.i4 -1992632313
xor <null>
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_109c453ca83947cdbaffee631c1cd507
xor <null>
ldsfld fHAvpcg7OK4qgpojvjN fHAvpcg7OK4qgpojvjN::Ob4gpJs6eh
call System.String fHAvpcg7OK4qgpojvjN::yjIg3cEcbp(System.Int32,fHAvpcg7OK4qgpojvjN)
newobj System.Void ok0XQHmA99koOJahtL.eQPpvIxy3XX0CYu5s0::.ctor(System.String,System.String)
newobj System.Void tP9x0Ot62Rf2dfYTKTA.pM5mrwtfos9EU1dS5Pt::.ctor(ok0XQHmA99koOJahtL.eQPpvIxy3XX0CYu5s0)
ldloc.s V_2
ldsfld WxBcUHgPvEN3nY3S3Si WxBcUHgPvEN3nY3S3Si::uaogMeUaDR
call System.Void WxBcUHgPvEN3nY3S3Si::yjIg3cEcbp(System.Object,System.Byte[],WxBcUHgPvEN3nY3S3Si)
ldc.i4 5
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_9480b75ad12a42deba7430e3dbc3f1e3
brtrue IL_0077: switch(IL_0097,IL_0118)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0118)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_68ce46949122466384471d1cfdf7b12e
brfalse IL_014F: switch(IL_016B)
pop <null>
ldc.i4 3
br IL_014F: switch(IL_016B)
br IL_014B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014B: ldloc V_0
br IL_016B: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_109c453ca83947cdbaffee631c1cd507
brtrue IL_0014: switch(IL_0039,IL_018F,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0039,IL_018F,IL_0038)
ldsfld p43tR2gqr7Mc8R01Mff p43tR2gqr7Mc8R01Mff::NEqgDVPDPh
call System.Void p43tR2gqr7Mc8R01Mff::yjIg3cEcbp(p43tR2gqr7Mc8R01Mff)
ldc.i4 6
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_4626b706d5d94700b264bb30e9ea3a9f
brtrue IL_0014: switch(IL_0039,IL_018F,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_018F,IL_0038)
Module Name
Tryxss.exe
Full Name
Tryxss.exe
EntryPoint
System.Void ObjK0OllbdScu2v6KU.REfOmLgwqrn6Cwq0rP::QbUTmooyC()
Scope Name
Tryxss.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tryxss
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ObjK0OllbdScu2v6KU.REfOmLgwqrn6Cwq0rP::QbUTmooyC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ret
ret <null>
nop <null>
ldsfld CBM1Qrgy4V8eNxidu0G CBM1Qrgy4V8eNxidu0G::yEegIcc534
call System.Byte[] CBM1Qrgy4V8eNxidu0G::yjIg3cEcbp(CBM1Qrgy4V8eNxidu0G)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_622ce3b26e9747ee9be6169283ad9ab2
brtrue IL_0077: switch(IL_0097,IL_0118)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0118)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0118: leave IL_0038
ldc.i4 -2072108864
ldc.i4 4
shl <null>
ldc.i4 852562046
xor <null>
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_5c982373e4b74d049464d12c62fd7d91
xor <null>
ldsfld fHAvpcg7OK4qgpojvjN fHAvpcg7OK4qgpojvjN::Ob4gpJs6eh
call System.String fHAvpcg7OK4qgpojvjN::yjIg3cEcbp(System.Int32,fHAvpcg7OK4qgpojvjN)
ldc.i4 -1321904843
ldc.i4 1
shr <null>
ldc.i4 -1992632313
xor <null>
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_109c453ca83947cdbaffee631c1cd507
xor <null>
ldsfld fHAvpcg7OK4qgpojvjN fHAvpcg7OK4qgpojvjN::Ob4gpJs6eh
call System.String fHAvpcg7OK4qgpojvjN::yjIg3cEcbp(System.Int32,fHAvpcg7OK4qgpojvjN)
newobj System.Void ok0XQHmA99koOJahtL.eQPpvIxy3XX0CYu5s0::.ctor(System.String,System.String)
newobj System.Void tP9x0Ot62Rf2dfYTKTA.pM5mrwtfos9EU1dS5Pt::.ctor(ok0XQHmA99koOJahtL.eQPpvIxy3XX0CYu5s0)
ldloc.s V_2
ldsfld WxBcUHgPvEN3nY3S3Si WxBcUHgPvEN3nY3S3Si::uaogMeUaDR
call System.Void WxBcUHgPvEN3nY3S3Si::yjIg3cEcbp(System.Object,System.Byte[],WxBcUHgPvEN3nY3S3Si)
ldc.i4 5
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_9480b75ad12a42deba7430e3dbc3f1e3
brtrue IL_0077: switch(IL_0097,IL_0118)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0118)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_68ce46949122466384471d1cfdf7b12e
brfalse IL_014F: switch(IL_016B)
pop <null>
ldc.i4 3
br IL_014F: switch(IL_016B)
br IL_014B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014B: ldloc V_0
br IL_016B: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_109c453ca83947cdbaffee631c1cd507
brtrue IL_0014: switch(IL_0039,IL_018F,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0039,IL_018F,IL_0038)
ldsfld p43tR2gqr7Mc8R01Mff p43tR2gqr7Mc8R01Mff::NEqgDVPDPh
call System.Void p43tR2gqr7Mc8R01Mff::yjIg3cEcbp(p43tR2gqr7Mc8R01Mff)
ldc.i4 6
ldsfld <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8} <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_f14d89fa2e834c0ca8216ef53ccf7450
ldfld System.Int32 <Module>{c3130eb5-552c-41d9-960d-97b2240e9ec8}::m_4626b706d5d94700b264bb30e9ea3a9f
brtrue IL_0014: switch(IL_0039,IL_018F,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_018F,IL_0038)

1 malicious · 7 files
EXEc81303a3e68fe520cd9ec146d1e158ef
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙