Suspicious
Suspect

c9667ff75651fe9ec67263ca2c0bca8d

Share on LinkedIn
Print
PE Executable
MD5: c9667ff75651fe9ec67263ca2c0bca8d
Size: 2.53 MB
application/x-dosexec

This sample is a 2.4 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 54 embedded or derived files. It matches 18 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050
MD5
c9667ff75651fe9ec67263ca2c0bca8d
Verdict
Inconclusive
File type
PE Executable · 2.4 MB

Cite this report: https://app.malva.re/sha256/dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
2.53 MB · 2,532,056 B
First seen
2026-10-20 09:30 · 7 days ago
Last seen
2026-10-20 09:30 · 7 days ago
Last analysis
2026-10-20 09:30 · 7 days ago
Hashes
MD5 c9667ff75651fe9ec67263ca2c0bca8d Sha1 1714c3167f810cf40584038f9637d7963624a60a Sha256 dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050 Sha384 2111b33ed3681d964559d2b11dfc923736fc904af007fb637fc69497ea8e053285d59918415fef3293418a120eb450bb Sha512 d9ef1640751702ff434a5dc35556c2e876ea51edb76859daefe1519bf8a1d1893a28f02a00e69d363583b1b6f40670563b483e0f4639ecfbca2b88fc595c65c3 SSDeep 24576:yXRQa+1xk+pJg5CXeQavrnPUwie38a0H2k4tMyFoBkkAd04wJAAh/jV1gJcPNZI3:GQaOxTruQawwr4H2jt1anywJAaDQ TLSH 9BC58D49F361DCF5EE2B137920759C122F62AC4E95A1AA4E248DF2293D733434463AF7
Detection
Symbol obfuscation
Low

54 files
EXEc9667ff75651fe9ec67263ca2c0bca8d
Structure
7Z7z-stream @ 0x0005BA68.7z
P7B[Authenticode]_8d407eb7.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 2secondary ignored: 6
bin 5img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll>arc:7zsfx
Shape pe:exe>pe:dll>arc:7zsfx
3 nodes
Path pe:exe>arc:7z
Shape pe:exe>arc:7z
2 nodes

Name Value
Info
Authenticode present at 0x266E00 size 13528 bytes
Info
PDB Path: D:\??????\MicaSetup\build\.dist\obj\Release\SilentSetup.pdb
Module Name
SilentSetup.exe
Full Name
SilentSetup.exe
EntryPoint
System.Void Nexify.Program::Main()
Scope Name
SilentSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SilentSetup
Assembly Version
5.5.0.0
Assembly Culture
<null>
Has PublicKey
True
PublicKey Token
30309d3d081a1272
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
653
Main Method
System.Void Nexify.Program::Main()
Main IL Instruction Count
58
Main IL 
call System.DateTime System.DateTime::get_Now()
ldc.i4 2026
ldc.i4.s 10
ldc.i4.s 11
ldc.i4.s 20
ldc.i4.0 <null>
ldc.i4.0 <null>
newobj System.Void System.DateTime::.ctor(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32,System.Int32)
call System.Boolean System.DateTime::op_LessThan(System.DateTime,System.DateTime)
brfalse.s IL_001F: call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.Hosting::CreateBuilder()
ret <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.Hosting::CreateBuilder()
ldc.i4.0 <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseLogger(Nexify.Design.Controls.IHostBuilder,System.Boolean)
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseDpiAware(Nexify.Design.Controls.IHostBuilder)
ldsfld System.Action`1<Nexify.Option> Nexify.Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_004E: call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseOptions(Nexify.Design.Controls.IHostBuilder,System.Action`1<Nexify.Option>)
pop <null>
ldsfld Nexify.Program/<>c Nexify.Program/<>c::<>9
ldftn System.Void Nexify.Program/<>c::<Main>b__0_0(Nexify.Option)
newobj System.Void System.Action`1<Nexify.Option>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<Nexify.Option> Nexify.Program/<>c::<>9__0_0
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseOptions(Nexify.Design.Controls.IHostBuilder,System.Action`1<Nexify.Option>)
ldsfld System.Action`1<Nexify.Extension.DependencyInjection.IServiceCollection> Nexify.Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_0072: call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseServices(Nexify.Design.Controls.IHostBuilder,System.Action`1<Nexify.Extension.DependencyInjection.IServiceCollection>)
pop <null>
ldsfld Nexify.Program/<>c Nexify.Program/<>c::<>9
ldftn System.Void Nexify.Program/<>c::<Main>b__0_1(Nexify.Extension.DependencyInjection.IServiceCollection)
newobj System.Void System.Action`1<Nexify.Extension.DependencyInjection.IServiceCollection>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<Nexify.Extension.DependencyInjection.IServiceCollection> Nexify.Program/<>c::<>9__0_1
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseServices(Nexify.Design.Controls.IHostBuilder,System.Action`1<Nexify.Extension.DependencyInjection.IServiceCollection>)
callvirt Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.IHostBuilder::CreateApp()
ldnull <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseLocale(Nexify.Design.Controls.IHostBuilder,System.String)
ldc.i4.2 <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseTheme(Nexify.Design.Controls.IHostBuilder,Nexify.Design.Controls.WindowsTheme)
ldsfld System.Action`1<System.Collections.Generic.Dictionary`2<System.String,System.Type>> Nexify.Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_00A7: call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UsePages(Nexify.Design.Controls.IHostBuilder,System.Action`1<System.Collections.Generic.Dictionary`2<System.String,System.Type>>)
pop <null>
ldsfld Nexify.Program/<>c Nexify.Program/<>c::<>9
ldftn System.Void Nexify.Program/<>c::<Main>b__0_2(System.Collections.Generic.Dictionary`2<System.String,System.Type>)
newobj System.Void System.Action`1<System.Collections.Generic.Dictionary`2<System.String,System.Type>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.Collections.Generic.Dictionary`2<System.String,System.Type>> Nexify.Program/<>c::<>9__0_2
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UsePages(Nexify.Design.Controls.IHostBuilder,System.Action`1<System.Collections.Generic.Dictionary`2<System.String,System.Type>>)
ldnull <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseDispatcherUnhandledExceptionCatched(Nexify.Design.Controls.IHostBuilder,System.Windows.Threading.DispatcherUnhandledExceptionEventHandler)
ldnull <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseDomainUnhandledExceptionCatched(Nexify.Design.Controls.IHostBuilder,System.UnhandledExceptionEventHandler)
ldnull <null>
call Nexify.Design.Controls.IHostBuilder Nexify.Design.Controls.HostBuilderExtension::UseUnobservedTaskExceptionCatched(Nexify.Design.Controls.IHostBuilder,System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
callvirt System.Void Nexify.Design.Controls.IHostBuilder::RunApp()
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙