Malicious
Malicious

02db485105be3075a8fff129ad9f105a

Share on LinkedIn
Print
PE Executable
MD5: 02db485105be3075a8fff129ad9f105a
Size: 786.43 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
786.43 KB · 786,432 B
First seen
2026-07-17 11:46 · 3 months ago
Last seen
2026-07-17 11:46 · 3 months ago
Last analysis
2026-07-17 17:40 · 3 months ago
Hashes
MD5 02db485105be3075a8fff129ad9f105a Sha1 acd23fc4348f98845d907e7bc57e151d182fcc91 Sha256 4bc0f3939bfb316ccfd6458797cbb9595f4f76d435a087478ea46bff60c89089 Sha384 c2ca61e738363f3f171d190455b1871f3896d2df4a5d465bd9ec9426ff978ad9749528ec771c73c07976ec39ee7513f8 Sha512 d4fca448434c0c9a02f719381505bece472df0f1e368e10f0859feb5a2d0e24d2bc4d89c714870ff4406eb6ad0b9beb4cc01791807e1e29f3259b8972f7b177d SSDeep 12288:uetyShabBkUBp7Q8sFHv+VuyG8AObsByGxtHNFyvNGKnsEYQcaXL:TUlpU8S2V7JAtyQNNFshsEYQca TLSH 62F4BF1B73568E21E2840236C1DB550187F16947B67BEB0E7984239B29033FBEE4B797
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE02db485105be3075a8fff129ad9f105a
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Nfxqhrfdyr.exe
Full Name
Nfxqhrfdyr.exe
EntryPoint
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name
Nfxqhrfdyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nfxqhrfdyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0129: ret
nop <null>
newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor()
call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro()
callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[])
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 2
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0129
leave IL_0129: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 6
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0129
leave IL_0129: ret
ldc.i4 2
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 5
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
ret <null>
Module Name
Nfxqhrfdyr.exe
Full Name
Nfxqhrfdyr.exe
EntryPoint
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Scope Name
Nfxqhrfdyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nfxqhrfdyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m19BVsCU5XtCJdpQ6S.gAUnBKpdYtZm3g1nTB::iZghdIPZZ()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0129: ret
nop <null>
newobj System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::.ctor()
call System.Byte[] Cpgyjjcbh.Properties.Ukzfkwgu::get_Rrutmqgumro()
callvirt System.Void h8Jrf4qtaUJqcW6LOF.GQIFmoWosDxfIVaY5w::LJlFhmJAE(System.Byte[])
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_f2194e9a15c145bbbab9a5b53ff54d72
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 2
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0129
leave IL_0129: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_17cd69be66dd42259bebddf0e9d60eb1
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 6
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0129
leave IL_0129: ret
ldc.i4 2
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_3cec950aa9fd415bbb5d99dd72a3437c
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
call System.Void XbiK0JKxHR9e5VBljmS.iHDoCjK9ZNLvN1cSY10::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 5
ldsfld <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b} <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_60f78811030d447fa2ae225ae39bc144
ldfld System.Int32 <Module>{4fc9c4df-954c-4e07-926d-1d62156f029b}::m_dd4b46481d7a4f3280c609dbad4df77e
brtrue IL_000D: switch(IL_0031,IL_0105,IL_0129)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0031,IL_0105,IL_0129)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙