Malicious PE Executable analysis – 488876e33932

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

2.02 MB · 2,017,280 B

First seen

2026-09-10 11:01 · one month ago

Last seen

2026-09-10 11:01 · one month ago

Last analysis

2026-09-11 04:01 · one month ago

Hashes

MD5 ef0f995be3134b1ed569bea4689d4d14 Sha1 d333e6f90dd2b09d7d514489037abe641e360587 Sha256 488876e33932b120645375553450ccd55cddda3a98e068a716b8fdf2fc5a9533 Sha384 bbee8fb9431b5cd5ed41b851b67f060e2d78cf2feacd620735114aa3db69c2409880a00cab3e19b1cb4af8b6c26fd35b Sha512 f2346235cff2bcabba4e902a54c0d4259778b166f54dcf605844f23d8f3086488fa68256f5aec21cce22b0e1252ae6f72592f848399ca6432cba2ae2515a89c3 SSDeep 24576:6pHlC4ZGxxPw3n9PoGsokmr3mcAgi4cEMvgNRMjgAAZ36DiOwgBneAk9yu:wXGnC5sokOSo4EEVeau TLSH DA95D13036AA9148E97A0B310CB556C117B73B667F44CB5E7988128D9D337278B12FEB

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Medium

1 malicious · 256 files

EXEef0f995be3134b1ed569bea4689d4d14

Structure

BINResources

BIN.Net Resources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Name	Value
Module Name	bKCx.exe
Full Name	bKCx.exe
EntryPoint	System.Void qIY.VIs::GIx()
Scope Name	bKCx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	bKCx
Assembly Version	8.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Info	PDB Path: bKCx.pdb
Total Strings	673
Main Method	System.Void qIY.VIs::GIx()
Main IL Instruction Count	12
Main IL	br IL_0006: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ret <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001F: ldc.i4.0 newobj System.Void AP0.PPr::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: ret ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_002A: call System.Void plv.AlW::Sx8() call System.Void plv.AlW::Sx8() br IL_0010: newobj System.Void AP0.PPr::.ctor()