Suspect
PE Executable
MD5: d77b96fe72bfd13d513ab559cba4b308
Size: 5.3 MB
application/x-dosexec
This sample is a 5.1 MB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704
- MD5
- d77b96fe72bfd13d513ab559cba4b308
- Verdict
- Inconclusive
- File type
- PE Executable · 5.1 MB
Cite this report: https://app.malva.re/sha256/5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
5.3 MB · 5,298,176 B
First seen
2026-10-06 21:30 · 25 days ago
Last seen
2026-10-06 21:30 · 25 days ago
Last analysis
2026-10-06 21:30 · 25 days ago
Hashes
MD5
d77b96fe72bfd13d513ab559cba4b308
Sha1
d3fd6ee9651ff08f2cd0a945365bd5b984f7cb54
Sha256
5ec4c1ecaf67ba48a7f6ccebc065e587e7629654e455b15f67894240e63ac704
Sha384
887b6872c55f167be621e2ee01f1d654919c1fb2070bfb776873eab4023126cb9d99dc79155722b3204df6e5f64cc4d0
Sha512
25ddf32dc6c6fd1b98327699232d28a97a700dc2048ea559ff31bf9cbe580c2aefbcd330c9e4fe0176bd1d7695c5ac008ef29ea924affaeb46655ed4980bfe71
SSDeep
98304:DI8qPoBhz1aRxcSUDk36SAEdhvK3R8yAVp2H:DI8qPe1Cxcxk3ZAEoR8yc4H
TLSH
2936334972A891FCD0050A7884B78E57B3F37C5A67FA4B0F4B80866B0D53B46EFA4742
Detection
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLMicrosoft v12.00 64bit C++ DLL - sign ASL ( 64 bit ) UPolyX 0.3 -> delikon
1 file
EXEd77b96fe72bfd13d513ab559cba4b308
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll
Shape
pe:dll
1 nodes
PE Layout
UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential