Deep Malware Analysis of 036f488bda0f0a1b7deb042eac153dda | md5: 036f488bda0f0a1b7deb042eac153dda | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.90

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	036f488bda0f0a1b7deb042eac153dda
Sha1	4d0ebadd007e7ea4d5e5fc2a29d60ebd4d144ce6
Sha256	f3acd382c98e29c098728d1de97133a1852609d62946207b18ed81b90e2215ff
Sha384	e320de22272e536eef1f01cd0e9cea1ce877bab645c21f5ea7d7fdb88e30efa5d7f3ca2cb1efc0ac80e0a00dce265f54
Sha512	901653c3b9120becf7ee508cec2a34f4cacde5b87c69e5ed0ec7950f86b0e26b6bae57c55154a72fb178f9da8bc390b2e2004b3502ca7940f31ac87502ca453d
SSDeep	12288:ZhQlouvvA2RtMkIQkLpaq1buGaSYpAEbP3vQXdYME7es0kJQO:7QloKvA2RtEQkLpaq1nie3yMQ0kJQO
TLSH	5A05E7017E44CE12F0191233C2EF4A4847F499516AA6E72B7DBA376E65127E73C0DACB

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	9dsavmbmfKEkOhdXmCBi
Full Name	9dsavmbmfKEkOhdXmCBi
EntryPoint	System.Void k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::k1bd0pIcVC()
Scope Name	9dsavmbmfKEkOhdXmCBi
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	YzUNX
Assembly Version	2.8.4.2
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::k1bd0pIcVC()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void rIbcOGNiSHnd0ZpydVa.BN8ExIN8HiVmmdrrmMD::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::HagdUvfg5r callvirt System.Void mdcB3Fw8VNYjoskIFch.JYyfWXwUOQ8eDg2enoO::Jo9R8dLsuq() nop <null> ret <null>`
Module Name	9dsavmbmfKEkOhdXmCBi
Full Name	9dsavmbmfKEkOhdXmCBi
EntryPoint	System.Void k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::k1bd0pIcVC()
Scope Name	9dsavmbmfKEkOhdXmCBi
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	YzUNX
Assembly Version	2.8.4.2
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::k1bd0pIcVC()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void rIbcOGNiSHnd0ZpydVa.BN8ExIN8HiVmmdrrmMD::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object k9q7jdw55OnGxbn3rlI.akAjOkwKTrOuffXkkCQ::HagdUvfg5r callvirt System.Void mdcB3Fw8VNYjoskIFch.JYyfWXwUOQ8eDg2enoO::Jo9R8dLsuq() nop <null> ret <null>`