Malicious PE Executable analysis – b856704dcb7b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.02 MB · 1,017,856 B

First seen

2026-09-10 11:01 · one month ago

Last seen

2026-09-10 11:01 · one month ago

Last analysis

2026-09-10 11:03 · one month ago

Hashes

MD5 f71681e3d2ab2b351dcafd96d1ebc9b3 Sha1 3ac43b83c9563d31be2a71e945eb9c1fdf362d74 Sha256 b856704dcb7b2f172d96f5a804628bc5ce615c7750a952b88eff541f16d5afe1 Sha384 aa3a55427891b7c4f06569c47875045061847d4d03bc3cfdc66031d5f2e85a0976459630f5b258ec4262b9de7b57f8ab Sha512 f4d5c303e66bf82f722ec213714bee5d1aaf08e0d86401d6b2da98282c56cfadfcc0978e562ce263f28f49384b39bd3686d698b9909f423081ed5d3e88db7a08 SSDeep 24576:cJZ8cHObaV05PWu6lCVIrLhLL8WlI5XcGgQ:5cp8eu6wqrR3lI5XcG TLSH 3B2512156B8BDC13C4761BB928D2D23013350DCAA463D06B5FDA3EDB3A36BA59AC4743

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

High

1 malicious · 20 files

EXEf71681e3d2ab2b351dcafd96d1ebc9b3

Structure

BIN.Net Resources

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	CAbz.exe
Full Name	CAbz.exe
EntryPoint	System.Void B9M.F99::r9T()
Scope Name	CAbz.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	CAbz
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	262
Main Method	System.Void B9M.F99::r9T()
Main IL Instruction Count	16
Main IL	`br IL_0007: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0022: nop nop <null> newobj System.Void O4.zv::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_002E: call System.Void z9P.S98::y0o() call System.Void z9P.S98::y0o() br IL_0012: nop`
Module Name	CAbz.exe
Full Name	CAbz.exe
EntryPoint	System.Void B9M.F99::r9T()
Scope Name	CAbz.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	CAbz
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	262
Main Method	System.Void B9M.F99::r9T()
Main IL Instruction Count	16
Main IL	`br IL_0007: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0022: nop nop <null> newobj System.Void O4.zv::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_002E: call System.Void z9P.S98::y0o() call System.Void z9P.S98::y0o() br IL_0012: nop`