Suspicious
Suspect

febe4bd1cbc7d6a5ec07554337e43f92

Share on LinkedIn
Print
PE Executable
MD5: febe4bd1cbc7d6a5ec07554337e43f92
Size: 929.28 KB
application/x-dosexec

This sample is a 907.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
e1cafc0e7f69f7e6c3ac6d53c55974487bf86663484c40c2d94952ea87ab8492
MD5
febe4bd1cbc7d6a5ec07554337e43f92
Verdict
Inconclusive
File type
PE Executable · 907.5 KB

Cite this report: https://app.malva.re/sha256/e1cafc0e7f69f7e6c3ac6d53c55974487bf86663484c40c2d94952ea87ab8492

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
929.28 KB · 929,280 B
First seen
2026-10-19 08:01 · 9 days ago
Last seen
2026-10-19 08:01 · 9 days ago
Last analysis
2026-10-19 08:02 · 9 days ago
Hashes
MD5 febe4bd1cbc7d6a5ec07554337e43f92 Sha1 0a9533b508db4889e987b6f4531f838ff7afb9c7 Sha256 e1cafc0e7f69f7e6c3ac6d53c55974487bf86663484c40c2d94952ea87ab8492 Sha384 7de880a22c92e36c45ce14ffa2b1ed4e75f0fdbeea9976cc785577239d3f8a9297322e6b88c8a1974cb39fe30f92ba43 Sha512 f952324e3f585ff4a77b03e29c6bfd1c19d25f797b221e8679508e0e5631a251700e97286837de404e5609430a801b79914a0f5c6da33bcd6be9718b19b1fbed SSDeep 24576:WD9Oq9JwjINInutlxsubXim+kY4RyEhVBw5C:WD9H9eENmubxbn+kY4oExw5 TLSH 411501282B15EA06C96967740AB2F3B417BD1DDDB402E2176FD86EEF3975F048D08683
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

9 files
EXEfebe4bd1cbc7d6a5ec07554337e43f92
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1

Name Value
Module Name
cQIy.exe
Full Name
cQIy.exe
EntryPoint
System.Void WhiskeyWarehouse.Program::Main()
Scope Name
cQIy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
cQIy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
390
Main Method
System.Void WhiskeyWarehouse.Program::Main()
Main IL Instruction Count
12
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Void WhiskeyWarehouse.VarastoRepository::InitializeData()
nop <null>
newobj System.Void WhiskeyWarehouse.FormaVarasto::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
cQIy.exe
Full Name
cQIy.exe
EntryPoint
System.Void WhiskeyWarehouse.Program::Main()
Scope Name
cQIy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
cQIy
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
390
Main Method
System.Void WhiskeyWarehouse.Program::Main()
Main IL Instruction Count
12
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Void WhiskeyWarehouse.VarastoRepository::InitializeData()
nop <null>
newobj System.Void WhiskeyWarehouse.FormaVarasto::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙