Suspicious
Suspect

d1dc20911470ed43af8bce0355fd0cf7

Share on LinkedIn
Print
PE Executable
MD5: d1dc20911470ed43af8bce0355fd0cf7
Size: 933.38 KB
application/x-dosexec

This sample is a 911.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 14 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
80571d10fe416a63ceb0c3b582c547573c41c1b1108ebda0e5604edf4532ff97
MD5
d1dc20911470ed43af8bce0355fd0cf7
Verdict
Inconclusive
File type
PE Executable · 911.5 KB

Cite this report: https://app.malva.re/sha256/80571d10fe416a63ceb0c3b582c547573c41c1b1108ebda0e5604edf4532ff97

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
933.38 KB · 933,376 B
First seen
2026-07-20 08:01 · 3 months ago
Last seen
2026-07-20 08:01 · 3 months ago
Last analysis
2026-07-21 03:21 · 3 months ago
Hashes
MD5 d1dc20911470ed43af8bce0355fd0cf7 Sha1 cf7fa092c3cec9deb2bb4a008535f540a6d1ec46 Sha256 80571d10fe416a63ceb0c3b582c547573c41c1b1108ebda0e5604edf4532ff97 Sha384 e004cc397d84cb411e24c998afb577bc6b30914a6aa3331c21136ef6e1202d9b183c82e1624a6aa8d13a158cccdbae6c Sha512 8d88835564a5fb7f2fde31504649598e3c221fdf19fefc39cdaebf89e72c6aedbc744c594f06289e86aee978cd3297eb2a93ab2fd806de19ae0a48cee9d2b182 SSDeep 24576:bFduf32/KsksCgDEuadDh8qmJLwh6Ylc:RC32yEEPDh8/JUjc TLSH 0A15121C6A48C901D1E20B719470F3B953F26D4DA932D31B4FECAF9B39B67065D18B2A
Detection
Symbol obfuscation
Low

15 files
EXEd1dc20911470ed43af8bce0355fd0cf7
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

4 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 2

Name Value
Module Name
fhYP.exe
Full Name
fhYP.exe
EntryPoint
System.Void HospitalManager.Program::Main()
Scope Name
fhYP.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
fhYP
Assembly Version
201.502.607.709
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
303
Main Method
System.Void HospitalManager.Program::Main()
Main IL Instruction Count
10
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
newobj System.Void HospitalManager.TriageDashboardForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙