Malicious PE Executable analysis – 91a9d6634d64

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3.51 MB · 3,514,368 B

First seen

2025-10-09 15:13 · one year ago

Last seen

2025-10-09 15:13 · one year ago

Last analysis

2025-10-09 21:35 · one year ago

Hashes

MD5 fd3fbabce26e5af7cb5f8858e0cb2e13 Sha1 1901807b261462653182704314f86f8938288a13 Sha256 91a9d6634d640740bd9153f86186e7ae5a68c7a9478c0f4519ac8de4dd3255fb Sha384 3e9d8b105d10892c9b101c8c0df54212f61db77623f9597025083343dcc18899557ed4fab4ab1fc98ba5f88f32a729a3 Sha512 d8bc33654b2302b1f68663bef136b836dcce775656801d7ccab6d07d5397c867dd063d97c16d6b1f71fbe9830ebacdf200e2d6087eebb289ee061d83b9c6412a SSDeep 49152:49zK/zcT8ZTkltEhvAKO43v8DJWPcBYL8BOYE8fhuw:49zK/w8wExL8BHJh TLSH 39F55B13FACE996AC200777EC6F706236370E6422327E71B7A5A53769847B776F01206

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 5 files

EXEfd3fbabce26e5af7cb5f8858e0cb2e13

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Sxrqatg.exe
Full Name	Sxrqatg.exe
EntryPoint	System.Void Sxrqatg.Evaluation.EvaluatorStruct::CancelEvaluator()
Scope Name	Sxrqatg.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Sxrqatg
Assembly Version	1.0.579.347
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Sxrqatg.Evaluation.EvaluatorStruct::CancelEvaluator()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void SteamKit2.Selections.LocatorEngine::.ctor() call System.Byte[] SteamKit2.Selections.LocatorEngine::RestartSelector() call System.Byte[] Sxrqatg.DataProcessing.AdaptableFilter::RefineInterruptibleFilter(System.Object) call System.Void SteamKit2.Values.ValueSubscriber::ValidateScopeValue(System.Object) ldc.i4 0 ldsfld <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874} <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874}::m_8428d61396cb481c853fe82698372e9d ldfld System.Int32 <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874}::m_7ae266ef0338462db5951a0fd90a2117 brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>
Module Name	Sxrqatg.exe
Full Name	Sxrqatg.exe
EntryPoint	System.Void Sxrqatg.Evaluation.EvaluatorStruct::CancelEvaluator()
Scope Name	Sxrqatg.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Sxrqatg
Assembly Version	1.0.579.347
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Sxrqatg.Evaluation.EvaluatorStruct::CancelEvaluator()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void SteamKit2.Selections.LocatorEngine::.ctor() call System.Byte[] SteamKit2.Selections.LocatorEngine::RestartSelector() call System.Byte[] Sxrqatg.DataProcessing.AdaptableFilter::RefineInterruptibleFilter(System.Object) call System.Void SteamKit2.Values.ValueSubscriber::ValidateScopeValue(System.Object) ldc.i4 0 ldsfld <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874} <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874}::m_8428d61396cb481c853fe82698372e9d ldfld System.Int32 <Module>{ec7f97bd-546a-42e0-a6f6-aa2976c5b874}::m_7ae266ef0338462db5951a0fd90a2117 brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>