Deep Malware Analysis of 02db485105be3075a8fff129ad9f105a | md5: 02db485105be3075a8fff129ad9f105a | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.89

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	02db485105be3075a8fff129ad9f105a
Sha1	acd23fc4348f98845d907e7bc57e151d182fcc91
Sha256	4bc0f3939bfb316ccfd6458797cbb9595f4f76d435a087478ea46bff60c89089
Sha384	c2ca61e738363f3f171d190455b1871f3896d2df4a5d465bd9ec9426ff978ad9749528ec771c73c07976ec39ee7513f8
Sha512	d4fca448434c0c9a02f719381505bece472df0f1e368e10f0859feb5a2d0e24d2bc4d89c714870ff4406eb6ad0b9beb4cc01791807e1e29f3259b8972f7b177d
SSDeep	12288:uetyShabBkUBp7Q8sFHv+VuyG8AObsByGxtHNFyvNGKnsEYQcaXL:TUlpU8S2V7JAtyQNNFshsEYQca
TLSH	62F4BF1B73568E21E2840236C1DB550187F16947B67BEB0E7984239B29033FBEE4B797

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Nfxqhrfdyr.exe
Full Name	Nfxqhrfdyr.exe
EntryPoint	System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name	Nfxqhrfdyr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Nfxqhrfdyr
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count	63
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0009: ldloc V_1 br IL_0129: ret nop <null> newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor() call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro() callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[]) ldc.i4 0 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72 brtrue IL_0072: switch(IL_008E) pop <null> ldc.i4 2 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_006E: ldloc V_0 br IL_008E: leave IL_0129 leave IL_0129: ret pop <null> ldc.i4 0 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1 brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 6 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0129 leave IL_0129: ret ldc.i4 2 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129) pop <null> ldc.i4 2 br IL_000D: switch(IL_0031,IL_0105,IL_0129) call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 5 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129) pop <null> ldc.i4 0 br IL_000D: switch(IL_0031,IL_0105,IL_0129) ret <null>
Module Name	Nfxqhrfdyr.exe
Full Name	Nfxqhrfdyr.exe
EntryPoint	System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name	Nfxqhrfdyr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Nfxqhrfdyr
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count	63
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0009: ldloc V_1 br IL_0129: ret nop <null> newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor() call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro() callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[]) ldc.i4 0 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72 brtrue IL_0072: switch(IL_008E) pop <null> ldc.i4 2 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_006E: ldloc V_0 br IL_008E: leave IL_0129 leave IL_0129: ret pop <null> ldc.i4 0 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1 brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 6 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0129 leave IL_0129: ret ldc.i4 2 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129) pop <null> ldc.i4 2 br IL_000D: switch(IL_0031,IL_0105,IL_0129) call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 5 ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144 ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129) pop <null> ldc.i4 0 br IL_000D: switch(IL_0031,IL_0105,IL_0129) ret <null>