Suspicious
Suspect

ed42ce21d96153ec00ba2e7cf1a14b68

PE Executable
MD5: ed42ce21d96153ec00ba2e7cf1a14b68
Size: 907.78 KB
application/x-dosexec

This sample is a 886.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
90e9fe6a776bbdc698f2b4506f1d6adf0efd0d259e04dc39a2e5c7446dae7f56
MD5
ed42ce21d96153ec00ba2e7cf1a14b68
Verdict
Inconclusive
File type
PE Executable · 886.5 KB

Cite this report: https://app.malva.re/sha256/90e9fe6a776bbdc698f2b4506f1d6adf0efd0d259e04dc39a2e5c7446dae7f56

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
907.78 KB · 907,776 B
First seen
2026-10-19 08:01 · 14 days ago
Last seen
2026-10-19 08:01 · 14 days ago
Last analysis
2026-10-19 08:01 · 14 days ago
Hashes
MD5 ed42ce21d96153ec00ba2e7cf1a14b68 Sha1 2e1daf3bd0a7f84c97e0a0a85d7dc057fc086330 Sha256 90e9fe6a776bbdc698f2b4506f1d6adf0efd0d259e04dc39a2e5c7446dae7f56 Sha384 e9c6849dc7266238731ecf5248bf71c2c3cb61a098288aa219ec4f315a7214b65eed07daec9722064e919efa4ffe6f57 Sha512 ab496a4a885dc301c783a733cb52e00e1c7064ce0644c710d2b76926b14061954f5aab99ecd1b09f347e488e90e9aecf10ee64a4ca220a402bc242e08829fdc1 SSDeep 12288:DhDQoMBGhfJt596hEdxMNOWb97LP8hfwy5/kYcfGGui7FKz7ucwbNmSHCFJ:D1QoMsXMhYMNOWb9HP8RefPMzMxUFJ TLSH 4515018A73804E34CD2B9D3540302DA8437B5F5A3EA9F6459E78BCB337736CA5892587
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

9 files
EXEed42ce21d96153ec00ba2e7cf1a14b68
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _26D74A48B5264C47_::_8A00CA1CD33D468B_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
1.2.33.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _26D74A48B5264C47_::_8A00CA1CD33D468B_()
Main IL Instruction Count
80
Main IL 
nop <null>
ldc.i4 -962045885
stloc.3 <null>
ldloc.3 <null>
ldc.i4 1841397607
mul <null>
ldc.i4 2094926825
ldc.i4 -1323055078
mul <null>
xor <null>
ldc.i4 723970231
mul <null>
ldc.i4 -1129087835
mul <null>
dup <null>
stloc.2 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_010D: ret
ldloc.1 <null>
ldsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
call System.Object _26D74A48B5264C47_::_D390A21D9D2A4F91_()
call System.Object _26D74A48B5264C47_::_97C70B6D11134994_(System.Object)
call System.String _26D74A48B5264C47_::_8ABCDB6F62824C9D_(System.Object)
call System.Boolean _26D74A48B5264C47_::_F2A92B825C624771_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 925228
stloc.s V_7
ldloc.2 <null>
ldc.i4 -507050
mul <null>
ldloc.s V_7
xor <null>
br.s IL_0006: stloc.3
call System.Object _26D74A48B5264C47_::_BE3AE876B4C64EDB_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
call System.Object _26D74A48B5264C47_::_D390A21D9D2A4F91_()
call System.Object _26D74A48B5264C47_::_97C70B6D11134994_(System.Object)
call System.String _26D74A48B5264C47_::_8ABCDB6F62824C9D_(System.Object)
call System.Boolean _26D74A48B5264C47_::_8EF4E23A4543478A_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 -1447923143
stloc.s V_5
ldloc.2 <null>
ldc.i4 -10319
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
call System.String _26D74A48B5264C47_::_F97EAF3D3DBF4937_()
ldc.i4 617895183
br.s IL_00BD: call System.String <Module>::_84E835C423C046E9_<System.String>(System.IntPtr)
call System.String <Module>::_84E835C423C046E9_<System.String>(System.IntPtr)
call System.String _26D74A48B5264C47_::_06CE714B42E24380_(System.String,System.String)
stsfld System.String _26D74A48B5264C47_::_FA266CBFB61C4F69_
ldsfld System.String _26D74A48B5264C47_::_FA266CBFB61C4F69_
call System.Byte[] _26D74A48B5264C47_::_50403086A6644EAB_(System.String)
stsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
ldc.i4 1169268942
stloc.s V_4
ldloc.2 <null>
ldc.i4 -994208
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _26D74A48B5264C47_::_5ED93328E1E24855_()
stloc.1 <null>
ldc.i4 -700001030
stloc.s V_6
ldloc.2 <null>
ldc.i4 -78397
mul <null>
ldloc.s V_6
xor <null>
br IL_0006: stloc.3
ret <null>
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _26D74A48B5264C47_::_8A00CA1CD33D468B_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
1.2.33.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _26D74A48B5264C47_::_8A00CA1CD33D468B_()
Main IL Instruction Count
80
Main IL 
nop <null>
ldc.i4 -962045885
stloc.3 <null>
ldloc.3 <null>
ldc.i4 1841397607
mul <null>
ldc.i4 2094926825
ldc.i4 -1323055078
mul <null>
xor <null>
ldc.i4 723970231
mul <null>
ldc.i4 -1129087835
mul <null>
dup <null>
stloc.2 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_010D: ret
ldloc.1 <null>
ldsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
call System.Object _26D74A48B5264C47_::_D390A21D9D2A4F91_()
call System.Object _26D74A48B5264C47_::_97C70B6D11134994_(System.Object)
call System.String _26D74A48B5264C47_::_8ABCDB6F62824C9D_(System.Object)
call System.Boolean _26D74A48B5264C47_::_F2A92B825C624771_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 925228
stloc.s V_7
ldloc.2 <null>
ldc.i4 -507050
mul <null>
ldloc.s V_7
xor <null>
br.s IL_0006: stloc.3
call System.Object _26D74A48B5264C47_::_BE3AE876B4C64EDB_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
call System.Object _26D74A48B5264C47_::_D390A21D9D2A4F91_()
call System.Object _26D74A48B5264C47_::_97C70B6D11134994_(System.Object)
call System.String _26D74A48B5264C47_::_8ABCDB6F62824C9D_(System.Object)
call System.Boolean _26D74A48B5264C47_::_8EF4E23A4543478A_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 -1447923143
stloc.s V_5
ldloc.2 <null>
ldc.i4 -10319
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
call System.String _26D74A48B5264C47_::_F97EAF3D3DBF4937_()
ldc.i4 617895183
br.s IL_00BD: call System.String <Module>::_84E835C423C046E9_<System.String>(System.IntPtr)
call System.String <Module>::_84E835C423C046E9_<System.String>(System.IntPtr)
call System.String _26D74A48B5264C47_::_06CE714B42E24380_(System.String,System.String)
stsfld System.String _26D74A48B5264C47_::_FA266CBFB61C4F69_
ldsfld System.String _26D74A48B5264C47_::_FA266CBFB61C4F69_
call System.Byte[] _26D74A48B5264C47_::_50403086A6644EAB_(System.String)
stsfld System.Byte[] _26D74A48B5264C47_::_819FABF157404C0A_
ldc.i4 1169268942
stloc.s V_4
ldloc.2 <null>
ldc.i4 -994208
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _26D74A48B5264C47_::_5ED93328E1E24855_()
stloc.1 <null>
ldc.i4 -700001030
stloc.s V_6
ldloc.2 <null>
ldc.i4 -78397
mul <null>
ldloc.s V_6
xor <null>
br IL_0006: stloc.3
ret <null>

9 files
EXEed42ce21d96153ec00ba2e7cf1a14b68
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙