Suspicious
Suspect

SWIFT07282026.exe

PE Executable
MD5: f7fb31cc8b2a0be022168204bcfd91a7
Size: 588.98 KB
application/x-dosexec

This sample is a 575.2 KB PE Executable. Malva.RE parsed it statically and found no known malware family, configuration or malicious signature. Static analysis extracted 28 embedded or derived files. It matches 1 YARA rule. Static analysis cannot prove a file is harmless: an unknown or heavily packed threat can go undetected. The file was parsed and decompiled, never executed.

SHA256
f68b0ab0aa45a9119c1a097c4d64dd3250733f771b34cec0699e3f9a7c88d79e
MD5
f7fb31cc8b2a0be022168204bcfd91a7
Verdict
No known threat found
File type
PE Executable · 575.2 KB

Cite this report: https://app.malva.re/sha256/f68b0ab0aa45a9119c1a097c4d64dd3250733f771b34cec0699e3f9a7c88d79e

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
588.98 KB · 588,976 B
Hashes
MD5 f7fb31cc8b2a0be022168204bcfd91a7 Sha1 bbe3b65bfddcacf116b310acd312395ef2d6b54e Sha256 f68b0ab0aa45a9119c1a097c4d64dd3250733f771b34cec0699e3f9a7c88d79e Sha384 b05bc10f4ae1b93e733f49ffc4aae737910822bb8de5418ca385718f6c54a9f523f1eeba8b5cc01e5c7af47bd11755f1 Sha512 27e7a715c078fb15618b4712d74b88865497e41b768d3af6d942532823a08a16dd7a8be405765027d0b2e99d52a693fdb28c4e6da6aa3dc5adb2c4b5243115f8 SSDeep 12288:AfYPo/gfgMUCPvcU8bLqd3sqItJSfgpf6DtdzfW9+:AfYPo/cgIH/8/qdGTpat9L TLSH 28C42312EBE0D8AAD4590973CD3263F7CAAEAD61D3284A8B47457D487D71383DA1F381
Detection
PeID
Microsoft Visual C++ v6.0 DLL

29 files
EXEf7fb31cc8b2a0be022168204bcfd91a7
Structure
BIN[NSIS Installer] @ #00029408
BINParalyzant
INIHoslagte.ini
BINBodsvandringer
IMGRudolf.jpg
IMGRudolf.jpg-preview.png
VASmetalarbejderen.vas
INIuopskaarede.ini
DLLSystem.dll
Structure
NSI][SETUP_DECOMPILED.NSI]
P7B[Authenticode]_b033fe56.p7b
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
BINID:1033
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_DIALOG
BINID:0069
BINID:1033
BINID:006A
BINID:1033
BINID:006F
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0067
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0001
BINID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 1secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes

Name Value
Info
Authenticode present at 0x8F380 size 2352 bytes

29 files
EXEf7fb31cc8b2a0be022168204bcfd91a7
Structure
P7B[Authenticode]_b033fe56.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙