Malicious
Malicious

f6108d316b56befc4cd5435939608908

PE Executable
MD5: f6108d316b56befc4cd5435939608908
Size: 846.85 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 827 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 3 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
d88d11dff0207fe4821ab60e5b1bcb25d43c473ecae4bc85df2244c59141555e
MD5
f6108d316b56befc4cd5435939608908
Verdict
Malicious
File type
PE Executable · 827 KB

Cite this report: https://app.malva.re/sha256/d88d11dff0207fe4821ab60e5b1bcb25d43c473ecae4bc85df2244c59141555e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
846.85 KB · 846,848 B
First seen
2026-10-27 07:15 · an hour ago
Last seen
2026-10-27 07:15 · an hour ago
Last analysis
2026-10-27 07:15 · an hour ago
Hashes
MD5 f6108d316b56befc4cd5435939608908 Sha1 b9a8843e8a004e114c243cfbe49b2cdf0c8fe890 Sha256 d88d11dff0207fe4821ab60e5b1bcb25d43c473ecae4bc85df2244c59141555e Sha384 8592d2ac5418d631c07352815b2a46802948639ab7af4feaf33567e38f365ae451065cbf44bf1eee7b8e71ae30c5605f Sha512 61c4a80bb092f2ae53a52316c4097db1247b839af726ea5d87f284986c1a97669882753c0f8dd675e72e1be46352005c095db30873398f7180856dc6926f4b21 SSDeep 12288:MfkC2KnTW8pCFuZHc0Ku/IgRfvTXc+neGIjjLrz+TbdZGWHW6OylEEBJWO:PYnTW7WIGvzc+3T66rEEBJb TLSH 5505F6117E44CE12F0091233C3EF458957B4D961AAA6E32B7DBA3B6E55123A73C0D9CB
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 4 files
EXEf6108d316b56befc4cd5435939608908
Structure
BIN.Net Resources
BINfotuojomAOPoxqOyZu.lV6TWCDqyln2uA7qRf
BINjM5wNWBsvvoVHqYCTX.FMdcUhWsE0SxHtSEhZ
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
Full Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
EntryPoint
System.Void U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::m9yc4lEFhO()
Scope Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hBzhMmIs7jjJYnxWKx
Assembly Version
3.1.2.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::m9yc4lEFhO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void v0IUp5cGoF7Qp6Gl7Zp.tfhB1fc66e3FOX7Nxc3::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::EIYcRdb31S
callvirt System.Void BNDZWHY6YD2HJYdJLkK.FiX3iOYTmlaExw5ZeQX::BZNoabeScX()
nop <null>
ret <null>
Module Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
Full Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
EntryPoint
System.Void U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::m9yc4lEFhO()
Scope Name
sIX7tnAfKHeMBoEA4JujP5vMJYfuy3PqPSctUHS3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hBzhMmIs7jjJYnxWKx
Assembly Version
3.1.2.7
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
63
Main Method
System.Void U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::m9yc4lEFhO()
Main IL Instruction Count
14
Main IL 
br.s IL_000B: ldc.i4.0
call <null>
ldnull <null>
ldc.i4.0 <null>
ldelem.ref <null>
pop <null>
ldc.i4.0 <null>
brtrue.s IL_0007: ldnull
call System.Void v0IUp5cGoF7Qp6Gl7Zp.tfhB1fc66e3FOX7Nxc3::kLjw4iIsCLsZtxc4lksN0j()
nop <null>
ldsfld System.Object U8BHxWYrK25gP70VgF9.tKq4r2Ygx72OqUCORVc::EIYcRdb31S
callvirt System.Void BNDZWHY6YD2HJYdJLkK.FiX3iOYTmlaExw5ZeQX::BZNoabeScX()
nop <null>
ret <null>

1 malicious · 4 files
EXEf6108d316b56befc4cd5435939608908
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙