Malicious
Malicious

0444dfa4bd00c74c8335cbcba1b667ea

PE Executable
MD5: 0444dfa4bd00c74c8335cbcba1b667ea
Size: 820.74 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0444dfa4bd00c74c8335cbcba1b667ea
Sha1 d88346deaec3d03a09ba430630dda992decd5bc4
Sha256 6a0fb35b3584468d5395c3d1402ae9ac568e04a883febd2ce495e3da7599e6ae
Sha384 a53c8165f161fac082e5b5b052c171dfd1529797a5d53ae8b5cad21aa8ea46bb3a4561d792d682a8d2633057db8fb9dc
Sha512 c183f0fc91cbdffbe70e136a93ffb9f7aebaaa570a79e3c71241c9a1d4867fc65d6526965842874375e7ec62a1f9a7d25c31055c49a91375422851dc1cd3f9a0
SSDeep 12288:DkzkOyI+68ROvBloxnjgvs8j/PC0W0kNZab+WeOMZSBTfCN6h:Dxh68IZ8jKsYanu+WeOEkCN6
TLSH DF05BF6636614E20D6880637D1D71411D3F5AA47BAA7F30F7A8813AA1D033FEEE07697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0444dfa4bd00c74c8335cbcba1b667ea
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
sKYUw8NgQIDdmY8ZAM.654HZ2W2wqBysXquFm
pYd4c6Z5b5pQFVEFcB.xJYVZ5PD9eLjQW32Wf
LB2pajGxtpQBVK8t46.KP6LiEVij9hfRiJ30t
ugVKZOYdq5N9TA8nQF.cvwCBVfCHeh5ixXBBh
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Lzlnrkkygd.exe
Full Name
Lzlnrkkygd.exe
EntryPoint
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Scope Name
Lzlnrkkygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lzlnrkkygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
call System.Void TCue3FVe0uOFaBgKYs6::OYkVl7E5cr(TCue3FVe0uOFaBgKYs6)
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_04da7b53e56045198e7ab1656db665fc
brfalse IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
nop <null>
newobj System.Void SCIyVFBEjNJD9sRIN3.N9Ev6fuFJXrk1WHQaM::.ctor()
ldsfld CSHyGqVKFhD6XNtARrD CSHyGqVKFhD6XNtARrD::U5KVhmRyPF
call System.Byte[] CSHyGqVKFhD6XNtARrD::OYkVl7E5cr(CSHyGqVKFhD6XNtARrD)
ldsfld owVjjGVQwQ1FkAsM1db owVjjGVQwQ1FkAsM1db::QLlVvKx7JN
call System.Void owVjjGVQwQ1FkAsM1db::OYkVl7E5cr(System.Object,System.Byte[],owVjjGVQwQ1FkAsM1db)
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_1fcd2059c26e4094a9f5be5f5c4f80b5
brfalse IL_00AC: switch(IL_00C8)
pop <null>
ldc.i4 0
br IL_00AC: switch(IL_00C8)
br IL_00A8: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00A8: ldloc V_0
br IL_00C8: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_d05baa314b38460099db6c1e8f34a088
brfalse IL_00FF: switch(IL_011B)
pop <null>
ldc.i4 0
br IL_00FF: switch(IL_011B)
br IL_00FB: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00FB: ldloc V_2
br IL_011B: leave IL_013F
leave IL_013F: ret
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_e65fb5c3028a4616ab9d4c56af4e71b2
brtrue IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
ret <null>
Module Name
Lzlnrkkygd.exe
Full Name
Lzlnrkkygd.exe
EntryPoint
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Scope Name
Lzlnrkkygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lzlnrkkygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
call System.Void TCue3FVe0uOFaBgKYs6::OYkVl7E5cr(TCue3FVe0uOFaBgKYs6)
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_04da7b53e56045198e7ab1656db665fc
brfalse IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
nop <null>
newobj System.Void SCIyVFBEjNJD9sRIN3.N9Ev6fuFJXrk1WHQaM::.ctor()
ldsfld CSHyGqVKFhD6XNtARrD CSHyGqVKFhD6XNtARrD::U5KVhmRyPF
call System.Byte[] CSHyGqVKFhD6XNtARrD::OYkVl7E5cr(CSHyGqVKFhD6XNtARrD)
ldsfld owVjjGVQwQ1FkAsM1db owVjjGVQwQ1FkAsM1db::QLlVvKx7JN
call System.Void owVjjGVQwQ1FkAsM1db::OYkVl7E5cr(System.Object,System.Byte[],owVjjGVQwQ1FkAsM1db)
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_1fcd2059c26e4094a9f5be5f5c4f80b5
brfalse IL_00AC: switch(IL_00C8)
pop <null>
ldc.i4 0
br IL_00AC: switch(IL_00C8)
br IL_00A8: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00A8: ldloc V_0
br IL_00C8: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_d05baa314b38460099db6c1e8f34a088
brfalse IL_00FF: switch(IL_011B)
pop <null>
ldc.i4 0
br IL_00FF: switch(IL_011B)
br IL_00FB: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00FB: ldloc V_2
br IL_011B: leave IL_013F
leave IL_013F: ret
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_e65fb5c3028a4616ab9d4c56af4e71b2
brtrue IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
ret <null>
0444dfa4bd00c74c8335cbcba1b667ea
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
sKYUw8NgQIDdmY8ZAM.654HZ2W2wqBysXquFm
pYd4c6Z5b5pQFVEFcB.xJYVZ5PD9eLjQW32Wf
LB2pajGxtpQBVK8t46.KP6LiEVij9hfRiJ30t
ugVKZOYdq5N9TA8nQF.cvwCBVfCHeh5ixXBBh
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙