Suspect
PE Executable
MD5: cbe634977c3347c4661d10ab66786b9f
Size: 5.3 MB
application/x-dosexec
This sample is a 5.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 7badcc939f598bb1e7c78e1a2aa59969b185ed50625bf257cd6adde96415db09
- MD5
- cbe634977c3347c4661d10ab66786b9f
- Verdict
- Inconclusive
- File type
- PE Executable · 5.1 MB
Cite this report: https://app.malva.re/sha256/7badcc939f598bb1e7c78e1a2aa59969b185ed50625bf257cd6adde96415db09
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
5.3 MB · 5,298,176 B
First seen
2026-07-20 13:15 · 3 months ago
Last seen
2026-07-20 13:15 · 3 months ago
Last analysis
2026-07-22 00:12 · 3 months ago
Hashes
MD5
cbe634977c3347c4661d10ab66786b9f
Sha1
f48932f89d74644ca4384d70236608503fe4d529
Sha256
7badcc939f598bb1e7c78e1a2aa59969b185ed50625bf257cd6adde96415db09
Sha384
975d51e33fd463c90ef6515a799c9e52c7303ac0c49a13894caa4397c25b72b1451ffa8a2719f490e77a046b840d73e8
Sha512
36779d57d621cb0b807dfb5f0a3cd676429e33915c4d7d0401a41298539eec9a18efb5e1e9e8cdfc7164e90c3e086af00d7140cd5e54024e80e16e7808a65031
SSDeep
49152:jnsnsEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARd:DMfPoBhz1aRxcSUDk36SAEd
TLSH
0736239932BC81FCD10625B484BB8E12F7B37C5E22FE5B0F9B40896A1E13B55BB50752
Detection
PeID
Microsoft Visual C++ v6.0 DLLMicrosoft v12.00 64bit C++ DLL - sign ASL ( 64 bit ) UPolyX 0.3 -> delikon
1 file
EXEcbe634977c3347c4661d10ab66786b9f
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll
Shape
pe:dll
1 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential