Deep Malware Analysis of 00e79bef6afee51218deb9ff80306e63 | md5: 00e79bef6afee51218deb9ff80306e63 | .Net | PE (Portable Executable) | Executable | SOS: 0.23 | Managed .NET | PE File Layout | Win 64 Exe | x64 | SOS: 0.16 | PDB Path | T1059.001 | T1027 | DeObfuscated | PowerShell | T1059.007

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	00e79bef6afee51218deb9ff80306e63
Sha1	16c5402eda5a04552c34fd0c672184248cda316b
Sha256	a5c6fa5d21978aa50faad84a401001340d87bc988bfb2e16093bbd0e06b53478
Sha384	11cd1686cec3332a55be8ac0536e3b4f607b30bdc22430881a84a8a83f44e798912dceb17cd63f298b9dd130d77bb9e2
Sha512	bfe46447b6457b581e2ed032128a399a682f4b5d652a23d8bd6e22f33581d2ed0959e15097635dc7b3ebf94c08538bdf54e6115e1257abde3d69f56d0dc1bfb8
SSDeep	196608:4NV+HmZK0Bzhc6umB3WfQUuo0BEKckLxuotH1PddfCGxRjOOxu4q:oV+G3c6uuW7St
TLSH	90B633BFE1B10500FEBE133E4675396C5B39020EEBA8655F0C9912B6F8361CE6D72592

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLL

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 15 STICH kept: 3secondary ignored: 12

bin 9img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>arc:zip>scr:ps1~T1027~T1059.001

Shape pe:exe>arc:zip>scr:ps1

malicious 3 nodes

Path pe:exe>arc:zip>arc:zip>scr:js~T1059.007

Shape pe:exe>arc:zip>arc:zip>scr:js

technique4 nodes

Name	Value
Module Name	Rightbar-1.5-windows-x64.exe
Full Name	Rightbar-1.5-windows-x64.exe
EntryPoint	System.Int32 Launcher::Main(System.String[])
Scope Name	Rightbar-1.5-windows-x64.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Rightbar-1.5-windows-x64
Assembly Version	1.5.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	48
Main Method	System.Int32 Launcher::Main(System.String[])
Main IL Instruction Count	269
Main IL	ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.2 <null> bne.un.s IL_0015: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --extract-only call System.Boolean System.String::op_Equality(System.String,System.String) br.s IL_0016: stloc.0 ldc.i4.0 <null> stloc.0 <null> ldc.i4.0 <null> ldstr Local\Polalee.Rightbar.Package newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> newobj System.Void Launcher/<>c__DisplayClass10::.ctor() stloc.s V_10 ldloc.1 <null> ldc.i4.0 <null> callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32) stloc.2 <null> leave.s IL_003B: ldloc.2 pop <null> ldc.i4.1 <null> stloc.2 <null> leave.s IL_003B: ldloc.2 ldloc.2 <null> brtrue.s IL_0046: ldloc.0 ldc.i4.0 <null> stloc.s V_12 leave IL_0340: ldloc.s V_12 ldloc.0 <null> brfalse.s IL_005F: ldstr "Local\\Rightbar.Show" ldarg.0 <null> ldc.i4.1 <null> ldelem.ref <null> call System.String System.IO.Path::GetFullPath(System.String) call System.String Launcher::Prepare(System.String) pop <null> ldc.i4.0 <null> stloc.s V_12 leave IL_0340: ldloc.s V_12 ldstr Local\Rightbar.Show ldloca.s V_3 call System.Boolean System.Threading.EventWaitHandle::TryOpenExisting(System.String,System.Threading.EventWaitHandle&) brfalse.s IL_008D: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldloc.3 <null> stloc.s V_13 ldloc.3 <null> callvirt System.Boolean System.Threading.EventWaitHandle::Set() pop <null> leave.s IL_0085: ldc.i4.0 ldloc.s V_13 brfalse.s IL_0084: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldc.i4.0 <null> stloc.s V_12 leave IL_0340: ldloc.s V_12 call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldloc.s V_10 ldc.i4.0 <null> stfld System.Int32 Launcher/<>c__DisplayClass10::result newobj System.Void Launcher/<>c__DisplayClass12::.ctor() stloc.s V_9 ldloc.s V_9 newobj System.Void System.Windows.Forms.Form::.ctor() stfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window newobj System.Void Launcher/<>c__DisplayClass14::.ctor() stloc.s V_8 ldloc.s V_8 ldloc.s V_9 stfld Launcher/<>c__DisplayClass12 Launcher/<>c__DisplayClass14::CS$<>8__locals13 ldloc.s V_8 ldloc.s V_10 stfld Launcher/<>c__DisplayClass10 Launcher/<>c__DisplayClass14::CS$<>8__locals11 ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldstr Rightbar callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4 440 ldc.i4 154 newobj System.Void System.Drawing.Size::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Form::set_ClientSize(System.Drawing.Size) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4.1 <null> callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4.3 <null> callvirt System.Void System.Windows.Forms.Form::set_FormBorderStyle(System.Windows.Forms.FormBorderStyle) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MaximizeBox(System.Boolean) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MinimizeBox(System.Boolean) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldc.i4.s 20 ldc.i4.s 27 ldc.i4.s 41 call System.Drawing.Color System.Drawing.Color::FromArgb(System.Int32,System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_BackColor(System.Drawing.Color) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window call System.Drawing.Color System.Drawing.Color::get_White() callvirt System.Void System.Windows.Forms.Control::set_ForeColor(System.Drawing.Color) ldsfld System.Reflection.Assembly Launcher::Self ldstr Rightbar.Icon callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldloc.s V_4 newobj System.Void System.Drawing.Icon::.ctor(System.IO.Stream) callvirt System.Void System.Windows.Forms.Form::set_Icon(System.Drawing.Icon) leave.s IL_0186: ldloc.s V_9 ldloc.s V_4 brfalse.s IL_0185: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() newobj System.Void System.Windows.Forms.Label::.ctor() stloc.s V_5 ldloc.s V_5 ldstr Making room for Rightbar… callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) ldloc.s V_5 ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Control::set_AutoSize(System.Boolean) ldloc.s V_5 ldc.i4.s 24 ldc.i4.s 24 ldc.i4 398 ldc.i4.s 38 newobj System.Void System.Drawing.Rectangle::.ctor(System.Int32,System.Int32,System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Bounds(System.Drawing.Rectangle) ldloc.s V_5 ldstr Segoe UI ldc.r4 16 ldc.i4.1 <null> newobj System.Void System.Drawing.Font::.ctor(System.String,System.Single,System.Drawing.FontStyle) callvirt System.Void System.Windows.Forms.Control::set_Font(System.Drawing.Font) ldloc.s V_5 callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() newobj System.Void System.Windows.Forms.Label::.ctor() stloc.s V_6 ldloc.s V_6 ldstr Getting everything ready. Just a moment. callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) ldloc.s V_6 ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Control::set_AutoSize(System.Boolean) ldloc.s V_6 ldc.i4.s 25 ldc.i4.s 72 ldc.i4 398 ldc.i4.s 28 newobj System.Void System.Drawing.Rectangle::.ctor(System.Int32,System.Int32,System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Bounds(System.Drawing.Rectangle) ldloc.s V_6 ldstr Segoe UI ldc.r4 11 newobj System.Void System.Drawing.Font::.ctor(System.String,System.Single) callvirt System.Void System.Windows.Forms.Control::set_Font(System.Drawing.Font) ldloc.s V_6 callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() newobj System.Void System.Windows.Forms.Label::.ctor() stloc.s V_7 ldloc.s V_7 ldstr Built by Shiva Kumar Vinnu · © 2026 callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) ldloc.s V_7 ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Control::set_AutoSize(System.Boolean) ldloc.s V_7 ldc.i4.s 25 ldc.i4.s 119 ldc.i4 398 ldc.i4.s 24 newobj System.Void System.Drawing.Rectangle::.ctor(System.Int32,System.Int32,System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Bounds(System.Drawing.Rectangle) ldloc.s V_7 call System.Drawing.Color System.Drawing.Color::get_LightSteelBlue() callvirt System.Void System.Windows.Forms.Control::set_ForeColor(System.Drawing.Color) ldloc.s V_7 ldstr Segoe UI ldc.r4 9 newobj System.Void System.Drawing.Font::.ctor(System.String,System.Single) callvirt System.Void System.Windows.Forms.Control::set_Font(System.Drawing.Font) ldloc.s V_7 callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) ldloc.s V_8 ldc.i4.1 <null> stfld System.Boolean Launcher/<>c__DisplayClass14::preparing ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldloc.s V_8 ldftn System.Void Launcher/<>c__DisplayClass14::<Main>b__d(System.Object,System.Windows.Forms.FormClosingEventArgs) newobj System.Void System.Windows.Forms.FormClosingEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_FormClosing(System.Windows.Forms.FormClosingEventHandler) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window ldloc.s V_8 ldftn System.Void Launcher/<>c__DisplayClass14::<Main>b__e(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_Shown(System.EventHandler) ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) leave.s IL_0302: ldloc.s V_10 ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window brfalse.s IL_0301: endfinally ldloc.s V_9 ldfld System.Windows.Forms.Form Launcher/<>c__DisplayClass12::window callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_10 ldfld System.Int32 Launcher/<>c__DisplayClass10::result stloc.s V_12 leave.s IL_0340: ldloc.s V_12 stloc.s V_11 ldloc.0 <null> brtrue.s IL_0327: ldc.i4.1 ldloc.s V_11 callvirt System.String System.Exception::get_Message() ldstr Rightbar ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_12 leave.s IL_0340: ldloc.s V_12 ldloc.2 <null> brfalse.s IL_0335: endfinally ldloc.1 <null> callvirt System.Void System.Threading.Mutex::ReleaseMutex() endfinally <null> ldloc.1 <null> brfalse.s IL_033F: endfinally ldloc.1 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_12 ret <null>
Info	PE Detect: PeReader OK (file layout)