Malicious
Malicious

ce55cb01f68a55870ab984ee3eaa5e38

PE Executable
MD5: ce55cb01f68a55870ab984ee3eaa5e38
Size: 1.32 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 1.3 MB PE Executable classified as malicious by Malva.RE. Static analysis extracted 13 embedded or derived files. It matches 18 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8
MD5
ce55cb01f68a55870ab984ee3eaa5e38
Verdict
Malicious
File type
PE Executable · 1.3 MB

Cite this report: https://app.malva.re/sha256/a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
1.32 MB · 1,322,005 B
First seen
2026-11-01 11:30 · 2 days ago
Last seen
2026-11-01 11:30 · 2 days ago
Last analysis
2026-11-01 11:30 · 2 days ago
Hashes
MD5 ce55cb01f68a55870ab984ee3eaa5e38 Sha1 ce544669ed16798c91f0294802d577cf54601e00 Sha256 a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8 Sha384 af6313ec46361604eb5021fa3ebfe5e31555ec7c04d1d98c9bc8711cdaa2e16666d3ebfadc5fa55d81cdddd9c7b1f51a Sha512 9862eb496351f480a5a3487f5a2041edcdaea6d5abc906e51c354064f3fbd7344ac4195566dcadafbf1fdafb9ff8ae63ac38d75d757573199d35ab11b4c33313 SSDeep 24576:uETjpVt1wdK5FUFQGN4cupIxDCvynSc32zgvnP36lJB:uEXlFUFQGCTQvnSc3kg/P3+JB TLSH BA559D2B37924F21C2891733D1E7941083EA954376ABE32F358113DA1A463FEDE1A797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

2 malicious · 14 files
EXEce55cb01f68a55870ab984ee3eaa5e38
Structure
EXEOverlay_7081bbe3.bin
Structure
BINOverlay_02161f0a.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINqYdFwfwmnSUVlKNQfF.deMR4y1hnURXnmNb6C
BINNe9YOqjQBvxcUAAHhj.Lt6MpQflEl0kYpXsF0
BINa7lNYUmvp0Qy0o5r2V.WYXDXNX92SoRqYj9OP
BINlKcvcmGRB1bTtsuKJk.BOQA2SsHQA3v0P6Vcb
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINM08shyXjp4Chh8HW6y.F54avtSFAZkK7rhCxB
BINQgGmUk4cuo1NPQN0Nw.XdmSuHYmBGFrXbYtPr
BINT1X05xepXSW3SyJdrS.VsiaEyxOZpKJaE0Ix5
BINteJmwkyVZCZ3B9TRgS.ZEBhhY7mglKfAGfkFs
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:exe>pe:rsrc>bin
Shape pe:exe>pe:exe>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:exe>bin
Shape pe:exe>pe:exe>bin
malicious 3 nodes

Name Value
Info
Overlay extracted: Overlay_7081bbe3.bin (875029 bytes)
Module Name
Tprmucju.exe
Full Name
Tprmucju.exe
EntryPoint
System.Void h8C2P6bglkA6EXrIa2.ArXyRfC0hnUEfSkbVi::qlSjk8oOr()
Scope Name
Tprmucju.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tprmucju
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void h8C2P6bglkA6EXrIa2.ArXyRfC0hnUEfSkbVi::qlSjk8oOr()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01AC: ret
ldsfld cNqPXRCcA2WoHspNMfK cNqPXRCcA2WoHspNMfK::SFbCM8VjhA
call System.Void cNqPXRCcA2WoHspNMfK::veDCfygNCA(cNqPXRCcA2WoHspNMfK)
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_c32366ae528a48599304c0138bfac25f
brtrue IL_0014: switch(IL_01AC,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01AC,IL_0061,IL_0038)
nop <null>
ldsfld Mp245tCtFvFfEoQJ8qm Mp245tCtFvFfEoQJ8qm::R39C6puePU
call System.Byte[] Mp245tCtFvFfEoQJ8qm::veDCfygNCA(Mp245tCtFvFfEoQJ8qm)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_a3ff0ba5465643319c23d8b25d41e7a3
brtrue IL_009F: switch(IL_00BF,IL_0135)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0135)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_0135: leave IL_01AC
ldc.i4 -614117782
ldc.i4 -197058993
xor <null>
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_785b42d4a33b4a68a44519a265dac0be
xor <null>
ldsfld hUXCjECqnkebrna3LJh hUXCjECqnkebrna3LJh::EE2Cw9BDeH
call System.String hUXCjECqnkebrna3LJh::veDCfygNCA(System.Int32,hUXCjECqnkebrna3LJh)
ldc.i4 1187117027
not <null>
ldc.i4 -1207528617
xor <null>
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_e8b482c08d9441a6ba10e16b96b2761f
xor <null>
ldsfld hUXCjECqnkebrna3LJh hUXCjECqnkebrna3LJh::EE2Cw9BDeH
call System.String hUXCjECqnkebrna3LJh::veDCfygNCA(System.Int32,hUXCjECqnkebrna3LJh)
newobj System.Void sEnfEcGjpZHCZeoLay.P8M8ThU7Qy9MyHHpSQ::.ctor(System.String,System.String)
newobj System.Void DtWTgtyOE1MDn43VrlH.Teo9huy1v4X4OSS1hiS::.ctor(sEnfEcGjpZHCZeoLay.P8M8ThU7Qy9MyHHpSQ)
ldloc.s V_0
ldsfld f9CDDYCZgR8dNQFETnT f9CDDYCZgR8dNQFETnT::GFLCrFJgQg
call System.Void f9CDDYCZgR8dNQFETnT::veDCfygNCA(System.Object,System.Byte[],f9CDDYCZgR8dNQFETnT)
ldc.i4 1
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_5e754b5d4afa4e328c8ec9d175989f19
brtrue IL_009F: switch(IL_00BF,IL_0135)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0135)
leave IL_01AC: ret
pop <null>
ldc.i4 2
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_33d495b072804e888d6d852fb6310043
brtrue IL_016C: switch(IL_0188)
pop <null>
ldc.i4 0
br IL_016C: switch(IL_0188)
br IL_0168: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0168: ldloc V_3
br IL_0188: leave IL_01AC
leave IL_01AC: ret
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_87a0b460ec344fa2aa2a475727bd0885
brfalse IL_0014: switch(IL_01AC,IL_0061,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01AC,IL_0061,IL_0038)
ret <null>
Module Name
Tprmucju.exe
Full Name
Tprmucju.exe
EntryPoint
System.Void h8C2P6bglkA6EXrIa2.ArXyRfC0hnUEfSkbVi::qlSjk8oOr()
Scope Name
Tprmucju.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tprmucju
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void h8C2P6bglkA6EXrIa2.ArXyRfC0hnUEfSkbVi::qlSjk8oOr()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01AC: ret
ldsfld cNqPXRCcA2WoHspNMfK cNqPXRCcA2WoHspNMfK::SFbCM8VjhA
call System.Void cNqPXRCcA2WoHspNMfK::veDCfygNCA(cNqPXRCcA2WoHspNMfK)
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_c32366ae528a48599304c0138bfac25f
brtrue IL_0014: switch(IL_01AC,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01AC,IL_0061,IL_0038)
nop <null>
ldsfld Mp245tCtFvFfEoQJ8qm Mp245tCtFvFfEoQJ8qm::R39C6puePU
call System.Byte[] Mp245tCtFvFfEoQJ8qm::veDCfygNCA(Mp245tCtFvFfEoQJ8qm)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_a3ff0ba5465643319c23d8b25d41e7a3
brtrue IL_009F: switch(IL_00BF,IL_0135)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0135)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_0135: leave IL_01AC
ldc.i4 -614117782
ldc.i4 -197058993
xor <null>
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_785b42d4a33b4a68a44519a265dac0be
xor <null>
ldsfld hUXCjECqnkebrna3LJh hUXCjECqnkebrna3LJh::EE2Cw9BDeH
call System.String hUXCjECqnkebrna3LJh::veDCfygNCA(System.Int32,hUXCjECqnkebrna3LJh)
ldc.i4 1187117027
not <null>
ldc.i4 -1207528617
xor <null>
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_e8b482c08d9441a6ba10e16b96b2761f
xor <null>
ldsfld hUXCjECqnkebrna3LJh hUXCjECqnkebrna3LJh::EE2Cw9BDeH
call System.String hUXCjECqnkebrna3LJh::veDCfygNCA(System.Int32,hUXCjECqnkebrna3LJh)
newobj System.Void sEnfEcGjpZHCZeoLay.P8M8ThU7Qy9MyHHpSQ::.ctor(System.String,System.String)
newobj System.Void DtWTgtyOE1MDn43VrlH.Teo9huy1v4X4OSS1hiS::.ctor(sEnfEcGjpZHCZeoLay.P8M8ThU7Qy9MyHHpSQ)
ldloc.s V_0
ldsfld f9CDDYCZgR8dNQFETnT f9CDDYCZgR8dNQFETnT::GFLCrFJgQg
call System.Void f9CDDYCZgR8dNQFETnT::veDCfygNCA(System.Object,System.Byte[],f9CDDYCZgR8dNQFETnT)
ldc.i4 1
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_5e754b5d4afa4e328c8ec9d175989f19
brtrue IL_009F: switch(IL_00BF,IL_0135)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0135)
leave IL_01AC: ret
pop <null>
ldc.i4 2
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_33d495b072804e888d6d852fb6310043
brtrue IL_016C: switch(IL_0188)
pop <null>
ldc.i4 0
br IL_016C: switch(IL_0188)
br IL_0168: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0168: ldloc V_3
br IL_0188: leave IL_01AC
leave IL_01AC: ret
ldc.i4 0
ldsfld <Module>{304dff71-d214-4a4a-ba0e-52429443d950} <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_2922e58d4dc940be8cd9da26df0348d2
ldfld System.Int32 <Module>{304dff71-d214-4a4a-ba0e-52429443d950}::m_87a0b460ec344fa2aa2a475727bd0885
brfalse IL_0014: switch(IL_01AC,IL_0061,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01AC,IL_0061,IL_0038)
ret <null>

2 malicious · 14 files
EXEce55cb01f68a55870ab984ee3eaa5e38
Structure
EXEOverlay_7081bbe3.bin
Structure
BINOverlay_02161f0a.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙