Malicious
Malicious

02db485105be3075a8fff129ad9f105a

PE Executable
MD5: 02db485105be3075a8fff129ad9f105a
Size: 786.43 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 02db485105be3075a8fff129ad9f105a
Sha1 acd23fc4348f98845d907e7bc57e151d182fcc91
Sha256 4bc0f3939bfb316ccfd6458797cbb9595f4f76d435a087478ea46bff60c89089
Sha384 c2ca61e738363f3f171d190455b1871f3896d2df4a5d465bd9ec9426ff978ad9749528ec771c73c07976ec39ee7513f8
Sha512 d4fca448434c0c9a02f719381505bece472df0f1e368e10f0859feb5a2d0e24d2bc4d89c714870ff4406eb6ad0b9beb4cc01791807e1e29f3259b8972f7b177d
SSDeep 12288:uetyShabBkUBp7Q8sFHv+VuyG8AObsByGxtHNFyvNGKnsEYQcaXL:TUlpU8S2V7JAtyQNNFshsEYQca
TLSH 62F4BF1B73568E21E2840236C1DB550187F16947B67BEB0E7984239B29033FBEE4B797
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
02db485105be3075a8fff129ad9f105a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
II9q4wlCxNXWRWq4bR.vCl3QvfH3PUPm9S6Tl
So55LFIjnfnixRssLg.D4E8L4o6Z7IoAW4WwW
AO5tN31HM5nJWfBu24.eMEhe2XJAVs0EBO9Dn
yhl6JiD7wJU8sFVALq.1pPnOCKOiXtA6wiKFP
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nfxqhrfdyr.exe
Full Name
Nfxqhrfdyr.exe
EntryPoint
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name
Nfxqhrfdyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nfxqhrfdyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0129: ret
nop <null>
newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor()
call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro()
callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[])
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 2
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0129
leave IL_0129: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 6
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0129
leave IL_0129: ret
ldc.i4 2
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 5
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
ret <null>
Module Name
Nfxqhrfdyr.exe
Full Name
Nfxqhrfdyr.exe
EntryPoint
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name
Nfxqhrfdyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nfxqhrfdyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0129: ret
nop <null>
newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor()
call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro()
callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[])
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 2
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0129
leave IL_0129: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 6
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0129
leave IL_0129: ret
ldc.i4 2
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 5
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
ret <null>
02db485105be3075a8fff129ad9f105a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
II9q4wlCxNXWRWq4bR.vCl3QvfH3PUPm9S6Tl
So55LFIjnfnixRssLg.D4E8L4o6Z7IoAW4WwW
AO5tN31HM5nJWfBu24.eMEhe2XJAVs0EBO9Dn
yhl6JiD7wJU8sFVALq.1pPnOCKOiXtA6wiKFP
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙