Malicious
Malicious

c927b19e7101727d15b1a28d0c4dc914

PE Executable
MD5: c927b19e7101727d15b1a28d0c4dc914
Size: 817.66 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 798.5 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
b99a44bb4bfe7004bdebaec8ecf33a44f3c75650f0f846b90cbefa1199ffe67a
MD5
c927b19e7101727d15b1a28d0c4dc914
Verdict
Malicious
File type
PE Executable · 798.5 KB

Cite this report: https://app.malva.re/sha256/b99a44bb4bfe7004bdebaec8ecf33a44f3c75650f0f846b90cbefa1199ffe67a

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
817.66 KB · 817,664 B
First seen
2026-11-04 11:30 · an hour ago
Last seen
2026-11-04 11:30 · an hour ago
Last analysis
2026-11-04 11:30 · an hour ago
Hashes
MD5 c927b19e7101727d15b1a28d0c4dc914 Sha1 5b5adbc09b17df68a46decf614699a1aa0eb19c2 Sha256 b99a44bb4bfe7004bdebaec8ecf33a44f3c75650f0f846b90cbefa1199ffe67a Sha384 bda7157f1224e25746c6f993935af4444add7e6f6efb5b72e67788a1efd32fb314a470df2bf0b4ca118424cba94f9ba1 Sha512 397ae7356b41c58f4679ba05a662381899fde3eb6b60c0fbd38c379aba7881c93ce45e5059e19cf0afcf0f02ca03fffbe2dafa7b580b4f0a1d3e7a4265e83211 SSDeep 12288:032OFCgkEh7Fle4wom2Fj07u3LEoJ7pcP++sqz1j0nW2I7q:+2+CKMs+7iL7CPJstnW29 TLSH 5F05BF5376524E65D1881B37C0CB5900C3E56E8266A7F70FB28433A62D463FEEE0A6D7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXEc927b19e7101727d15b1a28d0c4dc914
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINHkIBIjGdj2LoGfwxh7.VfjYCSyMqOMQS43tEK
BINotPgQfmDEv73P3eeJO.Hrsi0rkh5w6IgwDJFb
BINIr8t4m9avPyN75CsM0.12rieLn2wGCy5qQ2fo
BINQAraSWXXJBP1Ymg6Ia.WgqsXX2M4B4cbmAuY4
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Rfxamd.exe
Full Name
Rfxamd.exe
EntryPoint
System.Void kEiDOQ4f7nAawJAuak.ropnGTvht5JMXelvui::JIdQYbHRE()
Scope Name
Rfxamd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rfxamd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kEiDOQ4f7nAawJAuak.ropnGTvht5JMXelvui::JIdQYbHRE()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld nxGSYCkZvndNCCcScnE nxGSYCkZvndNCCcScnE::L5uk0V9JgZ
ldsfld nxGSYCkZvndNCCcScnE nxGSYCkZvndNCCcScnE::L5uk0V9JgZ
call System.Void nxGSYCkZvndNCCcScnE::u2EkrQu6TR(nxGSYCkZvndNCCcScnE)
ldc.i4 0
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_f47f6daec2e84a729ba615b3cb72836a
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
newobj System.Void HT490rofF3VdoAFqbO.hScC08bWOm0wpvHsWP::.ctor()
ldsfld eibQCEkNvw1A16p23Of eibQCEkNvw1A16p23Of::RCykiEeYQ4
call System.Void eibQCEkNvw1A16p23Of::u2EkrQu6TR(System.Object,eibQCEkNvw1A16p23Of)
ldc.i4 3
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_fb42d3cad5c748e2a88479b6539665f1
brfalse IL_00A3: switch(IL_00BF)
pop <null>
ldc.i4 0
br IL_00A3: switch(IL_00BF)
br IL_009F: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_009F: ldloc V_0
br IL_00BF: leave IL_0061
leave IL_0061: ret
pop <null>
ldc.i4 3
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9122b476c32741608c17015321524f95
brtrue IL_00F6: switch(IL_0112)
pop <null>
ldc.i4 0
br IL_00F6: switch(IL_0112)
br IL_00F2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00F2: ldloc V_2
br IL_0112: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_2cd28b38d0fd43f48639c5511da2519c
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Rfxamd.exe
Full Name
Rfxamd.exe
EntryPoint
System.Void kEiDOQ4f7nAawJAuak.ropnGTvht5JMXelvui::JIdQYbHRE()
Scope Name
Rfxamd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rfxamd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kEiDOQ4f7nAawJAuak.ropnGTvht5JMXelvui::JIdQYbHRE()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld nxGSYCkZvndNCCcScnE nxGSYCkZvndNCCcScnE::L5uk0V9JgZ
ldsfld nxGSYCkZvndNCCcScnE nxGSYCkZvndNCCcScnE::L5uk0V9JgZ
call System.Void nxGSYCkZvndNCCcScnE::u2EkrQu6TR(nxGSYCkZvndNCCcScnE)
ldc.i4 0
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_f47f6daec2e84a729ba615b3cb72836a
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
newobj System.Void HT490rofF3VdoAFqbO.hScC08bWOm0wpvHsWP::.ctor()
ldsfld eibQCEkNvw1A16p23Of eibQCEkNvw1A16p23Of::RCykiEeYQ4
call System.Void eibQCEkNvw1A16p23Of::u2EkrQu6TR(System.Object,eibQCEkNvw1A16p23Of)
ldc.i4 3
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_fb42d3cad5c748e2a88479b6539665f1
brfalse IL_00A3: switch(IL_00BF)
pop <null>
ldc.i4 0
br IL_00A3: switch(IL_00BF)
br IL_009F: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_009F: ldloc V_0
br IL_00BF: leave IL_0061
leave IL_0061: ret
pop <null>
ldc.i4 3
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9122b476c32741608c17015321524f95
brtrue IL_00F6: switch(IL_0112)
pop <null>
ldc.i4 0
br IL_00F6: switch(IL_0112)
br IL_00F2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00F2: ldloc V_2
br IL_0112: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{676194e9-c205-4776-978c-096c700446d0} <Module>{676194e9-c205-4776-978c-096c700446d0}::m_9ebb7dcc4a5d4b539c097bc140e7eb17
ldfld System.Int32 <Module>{676194e9-c205-4776-978c-096c700446d0}::m_2cd28b38d0fd43f48639c5511da2519c
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0038,IL_0061)

1 malicious · 7 files
EXEc927b19e7101727d15b1a28d0c4dc914
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙