ef0f995be3134b1ed569bea4689d4d14

PE Executable

MD5: ef0f995be3134b1ed569bea4689d4d14

Size: 2.02 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

2.02 MB · 2,017,280 B

First seen

2026-09-10 11:01 · one month ago

Last seen

2026-09-10 11:01 · one month ago

Last analysis

2026-09-11 04:01 · one month ago

Hashes

MD5 ef0f995be3134b1ed569bea4689d4d14 Sha1 d333e6f90dd2b09d7d514489037abe641e360587 Sha256 488876e33932b120645375553450ccd55cddda3a98e068a716b8fdf2fc5a9533 Sha384 bbee8fb9431b5cd5ed41b851b67f060e2d78cf2feacd620735114aa3db69c2409880a00cab3e19b1cb4af8b6c26fd35b Sha512 f2346235cff2bcabba4e902a54c0d4259778b166f54dcf605844f23d8f3086488fa68256f5aec21cce22b0e1252ae6f72592f848399ca6432cba2ae2515a89c3 SSDeep 24576:6pHlC4ZGxxPw3n9PoGsokmr3mcAgi4cEMvgNRMjgAAZ36DiOwgBneAk9yu:wXGnC5sokOSo4EEVeau TLSH DA95D13036AA9148E97A0B310CB556C117B73B667F44CB5E7988128D9D337278B12FEB

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Medium

1 malicious · 256 files

EXEef0f995be3134b1ed569bea4689d4d14

Structure

BINResources

BINRT_ICON

BINID:0001

BINID:0

BINID:0002

BINID:0

BINID:0003

BINID:0

BINID:0004

BINID:0

BINID:0005

BINID:0

BINID:0006

IMGID:0

IMGID:0-preview.png

BINRT_GROUP_CURSOR4

BINID:7F00

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINci.GV.resources

DOCKpanel1.Dock

SIZEpanel1.Size

BINcheckThink.Anchor

SIZErichTextMsg.Size

FONTrichTextMsg.Font

BINbutEdit.Margin

BINbutRegen.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

SIZEbutDelete.Size

SIZElabelRole.Size

FONTlabelRole.Font

BINbutRegen.Location

BINbutEdit.Location

BINbutEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINrichTextMsg.ScrollBars

BINrichTextMsg.Anchor

BINbutDelete.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINcheckThink.Location

BINbutDelete.Location

SIZEcheckThink.Size

BINlabelRole.Location

BINrichTextMsg.Location

BIN$this.AutoScaleDimensions

BINbutCancelEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINpanel1.Location

BINbutApplyEdit.Image

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

BINAP0.PPr.resources

BINradioBasicVAD.Margin

SIZEtoolStripStatusLabel1.Size

BINlabel10.Margin

BINtabPageHuggingFace.Location

BINnumFreqThreshold.Location

SIZElistViewMeta.Size

BINcheckCMDEnable.ImeMode

BINnumCtxSize.Location

BINcheckMLock.Location

BINcheckLoadAuto.Anchor

BINtextGoogleApiKey.Location

BINcheckOverrideJinjaModel.TextAlign

BINtextSearchTerm.Anchor

BINbutSearch.Location

SIZElabel12.Size

BINbutVADDown.Location

SIZEradioBasicVAD.Size

BINgroupCommon.Location

BINnumMinP.Location

BINnumVadThreshold.Location

BINcheckOverrideSettings.Location

SIZElabel13.Size

SIZEgroupCommonModel.Size

SIZEcheckStream.Size

SIZElabel16.Size

BINtextSystemPrompt.Location

BINnumGenDelay.Location

BINnumTemp.Location

SIZElabel14.Size

BINlabel28.Location

ICON$this.Icon

BIN[NBF]root.IconData

BINcheckMarkdown.Location

SIZElabel17.Size

BINlabel19.Location

SIZEtabControl1.Size

SIZEcheckFileListEnable.Size

SIZElabel15.Size

BINlabel30.Margin

SIZEcomboVADModel.Size

BINcheckStream.Location

BINbutApplyModelSettings.Location

SIZElabelEditing.Size

FONTlabelEditing.Font

BINlabel7.Location

BINlabel10.Location

BINcheckFileCreateEnable.Location

SIZEpanelChat.Size

SIZElabel19.Size

BINnumTopK.Location

SIZElabel20.Size

BINcheckDateTimeEnable.Location

BINgroupAdvanced.Location

BIN$this.ClientSize

SIZElabel22.Size

BINbutApply.Location

SIZEcheckMarkdown.Size

BINnumWhisperTemp.Location

SIZEtextInput.Size

BINlabel22.Location

SIZEstatusStrip1.Size

SIZElabel3.Size

SIZEgroupBox8.Size

SIZElistViewHugSearch.Size

BINtextSearchTerm.Location

BINbutGen.Location

SIZElabel1.Size

BINtextModelsPath.Location

SIZEnumWhisperTemp.Size

BINcomboVADModel.Location

SIZEgroupBox6.Size

SIZEgroupBox7.Size

SIZEgroupAdvancedModel.Size

SIZElabelTPS.Size

SIZEgroupBox4.Size

SIZEbutSearch.Size

BINlabel29.Location

BINtextInput.ScrollBars

BINnumWakeWordSimilarity.Location

BINnumApiServerPort.Location

SIZEgroupBox2.Size

BINlabel8.Location

BINcheckFlashAttnModel.Location

BINlabel12.Location

BINlabel20.Location

BINlabel23.Location

BINcheckOverrideJinjaModel.Location

BINstatusStrip1.Padding

BINlabel11.Location

BINcheckVoiceInput.Location

SIZEgroupBox1.Size

BINsplitContainer2.Orientation

BINbutBrowse.Location

BINnumTopP.Location

SIZElabelPreGen.Size

BINnumGoogleResults.Location

SIZEsplitContainer1.Size

BINgroupBox4.Location

BINcheckFileReadEnable.Location

BINpanelChat.FlowDirection

SIZEtextModelsPath.Size

SIZEsplitContainer3.Size

SIZElabelSystemPromptModel.Size

BINbutWhispDown.Location

BINnumTopPModel.Location

SIZEgroupCPUParamsBatch.Size

BINlabel9.Location

SIZEtextSearchTerm.Size

BINcheckFlashAttn.Location

BINtextJinjaTmplModel.Location

SIZElabelTokens.Size

BINbutReset.Location

BINcheckDialectic.Location

BINcheckWhisperUseGPU.Location

SIZElistViewHugFiles.Size

SIZEcheckAutoScroll.Size

BINgroupBox6.Location

BINgroupBox5.Location

SIZEcheckFileWriteEnable.Size

BINsplitContainer3.Location

SIZEtextGoogleSearchID.Size

BINlabelSystemPromptModel.Location

BINlabel13.Location

SIZEbutVADDown.Size

SIZElabel30.Size

BINlabel30.Location

BINlabel21.Location

SIZEprogressBar1.Size

BINcheckMMap.Location

BINlinkFileInstruction.Location

BINFV7

SIZEgroupAdvanced.Size

SIZEtextGoogleApiKey.Size

BINlabel14.Location

BINcheckAutoScroll.Location

BINstatusStrip1.Location

SIZEtextSystemPromptModel.Size

BINgroupBox7.Location

BINbutGen.Anchor

SIZEtextFileBasePath.Size

SIZEtextJinjaTmplModel.Size

BINlabel26.Location

BINbutCodeBlock.Location

SIZEgroupCommon.Size

SIZEcheckVoiceInput.Size

SIZEcomboNUMAStrat.Size

BINcheckSpeak.Location

SIZEtextSystemPrompt.Size

BINprogressBar1.Anchor

SIZElinkFileInstruction.Size

BINcheckFileWriteEnable.Location

BINlabel16.Location

BINlabel24.Location

BINnumRepPen.Location

SIZEcheckDialectic.Size

SIZEtextWakeWord.Size

BINlabel15.Location

BINcomboWhisperModel.Location

BINtoolTip1.TrayLocation

BINgroupCPUParamsBatch.Location

SIZEtabPageModelSettings.Size

BINlabel3.Location

SIZEtabPageSettings.Size

SIZEbutCodeBlock.Size

BINopenFileDialog1.TrayLocation

BINstatusStrip1.TrayLocation

SIZEcheckSpeak.Size

BINgroupBox2.Location

BINgroupBox1.Location

BINgroupCPUParams.Location

SIZElistViewModels.Size

BIN$this.StartPosition

BINcheckLoadAuto.Location

SIZEnumGoogleResults.Size

BINtextSystemPromptModel.Location

BINtextFileBasePath.Location

BINlinkFileInstruction.Anchor

BINlabel17.Location

BINgroupCommonModel.Location

BINbutBrowseJinjaTmplModel.Location

BINnumBatchSize.Location

BINlabel25.Location

BINgroupAdvancedModel.Location

BINlabel4.Location

BINtextWakeWord.Location

BINfolderBrowserDialog1.TrayLocation

SIZEtabControlModelStuff.Size

BINgroupBox8.Location

BIN$this.AutoScaleDimensions

SIZEcheckLoadAuto.Size

BINnumNGen.Location

BINtextGoogleSearchID.Location

BINlabel18.Location

BINgroupJinjaTmplModel.Location

BINlabel6.Location

SIZEcheckOverrideSettings.Size

BINcheckApiServerEnable.Location

BINgroupBox3.Location

BINbKCx.g.resources

BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources

ICON$this.Icon

BIN[NBF]root.IconData

BINprogressBar1.Modifiers

BIN$this.Language

BIN$this.GridSize

BINLMStud.Properties.Resources.resources

BINUUoS

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Name	Value
Module Name	bKCx.exe
Full Name	bKCx.exe
EntryPoint	System.Void qIY.VIs::GIx()
Scope Name	bKCx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	bKCx
Assembly Version	8.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Info	PDB Path: bKCx.pdb
Total Strings	673
Main Method	System.Void qIY.VIs::GIx()
Main IL Instruction Count	12
Main IL	br IL_0006: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ret <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001F: ldc.i4.0 newobj System.Void AP0.PPr::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: ret ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_002A: call System.Void plv.AlW::Sx8() call System.Void plv.AlW::Sx8() br IL_0010: newobj System.Void AP0.PPr::.ctor()

1 malicious · 256 files

EXEef0f995be3134b1ed569bea4689d4d14

Structure

BINResources

BIN.Net Resources

No malware configuration was found at this point.