Malicious
Malicious

cc028c2c3e90d682d77ef53545ce6b24

PE Executable
MD5: cc028c2c3e90d682d77ef53545ce6b24
Size: 915.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
915.46 KB · 915,456 B
First seen
2026-10-09 12:00 · 16 days ago
Last seen
2026-10-09 12:00 · 16 days ago
Last analysis
2026-10-09 12:00 · 16 days ago
Hashes
MD5 cc028c2c3e90d682d77ef53545ce6b24 Sha1 6a1dda2436bda3e46f79b26c031838f8ebcb799d Sha256 05e61a33cd451d1496c7cf05a3f7bf739708ad2198d1ef2f05dc1f5eb2236138 Sha384 ccdaaa657e251a4e85646014e2d84486dedbd323cf800db956195dd1f70e028202b560e2b1872656f82ef410d3033a13 Sha512 b97fab95d38ab4edc7fd39e7e90600a08160384e003150bdfccad69b808e5ad79bce0b12be4c99fcd10a148be2f311656185341bbe9f6d5edbbc43475045a0f8 SSDeep 24576:orPIVkcKX8ZNQ7tJiyoXzDDC+4XdQ7fAvWy46yrwThlAb:or6jfZKJzozfCxdQ+WNFMU TLSH 0615AEAA3ADAD82AF0661F70C4A1F3F203B49D81E711D217CAD57DD77A31B80568634B
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 19 files
EXEcc028c2c3e90d682d77ef53545ce6b24
Structure
BIN.Net Resources
BINK4.R9.resources
BINKDb.YDw.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINAlpinePasture.Properties.Resources.resources
BINKL
DATA[NBF]root.Data
BINvCfN
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
lhpu.exe
Full Name
lhpu.exe
EntryPoint
System.Void LSq.TSU::cS3()
Scope Name
lhpu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
lhpu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
741
Main Method
System.Void LSq.TSU::cS3()
Main IL Instruction Count
19
Main IL 
br IL_0015: nop
nop <null>
newobj System.Void K4.R9::.ctor()
stsfld K4.R9 LSq.TSU::KEF
br IL_0038: ldsfld K4.R9 LSq.TSU::KEF
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002A: nop
call System.Void cE8.LEj::hPP()
br IL_0005: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0020: call System.Void cE8.LEj::hPP()
nop <null>
ret <null>
ldsfld K4.R9 LSq.TSU::KEF
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0036: nop
Module Name
lhpu.exe
Full Name
lhpu.exe
EntryPoint
System.Void LSq.TSU::cS3()
Scope Name
lhpu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
lhpu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
741
Main Method
System.Void LSq.TSU::cS3()
Main IL Instruction Count
19
Main IL 
br IL_0015: nop
nop <null>
newobj System.Void K4.R9::.ctor()
stsfld K4.R9 LSq.TSU::KEF
br IL_0038: ldsfld K4.R9 LSq.TSU::KEF
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_002A: nop
call System.Void cE8.LEj::hPP()
br IL_0005: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0020: call System.Void cE8.LEj::hPP()
nop <null>
ret <null>
ldsfld K4.R9 LSq.TSU::KEF
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0036: nop
1 malicious · 19 files
EXEcc028c2c3e90d682d77ef53545ce6b24
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙