Malicious
Malicious

0444dfa4bd00c74c8335cbcba1b667ea

Share on LinkedIn
Print
PE Executable
MD5: 0444dfa4bd00c74c8335cbcba1b667ea
Size: 820.74 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0444dfa4bd00c74c8335cbcba1b667ea
Sha1 d88346deaec3d03a09ba430630dda992decd5bc4
Sha256 6a0fb35b3584468d5395c3d1402ae9ac568e04a883febd2ce495e3da7599e6ae
Sha384 a53c8165f161fac082e5b5b052c171dfd1529797a5d53ae8b5cad21aa8ea46bb3a4561d792d682a8d2633057db8fb9dc
Sha512 c183f0fc91cbdffbe70e136a93ffb9f7aebaaa570a79e3c71241c9a1d4867fc65d6526965842874375e7ec62a1f9a7d25c31055c49a91375422851dc1cd3f9a0
SSDeep 12288:DkzkOyI+68ROvBloxnjgvs8j/PC0W0kNZab+WeOMZSBTfCN6h:Dxh68IZ8jKsYanu+WeOEkCN6
TLSH DF05BF6636614E20D6880637D1D71411D3F5AA47BAA7F30F7A8813AA1D033FEEE07697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0444dfa4bd00c74c8335cbcba1b667ea
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
sKYUw8NgQIDdmY8ZAM.654HZ2W2wqBysXquFm
pYd4c6Z5b5pQFVEFcB.xJYVZ5PD9eLjQW32Wf
LB2pajGxtpQBVK8t46.KP6LiEVij9hfRiJ30t
ugVKZOYdq5N9TA8nQF.cvwCBVfCHeh5ixXBBh
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Lzlnrkkygd.exe
Full Name
Lzlnrkkygd.exe
EntryPoint
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Scope Name
Lzlnrkkygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lzlnrkkygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
call System.Void TCue3FVe0uOFaBgKYs6::OYkVl7E5cr(TCue3FVe0uOFaBgKYs6)
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_04da7b53e56045198e7ab1656db665fc
brfalse IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
nop <null>
newobj System.Void SCIyVFBEjNJD9sRIN3.N9Ev6fuFJXrk1WHQaM::.ctor()
ldsfld CSHyGqVKFhD6XNtARrD CSHyGqVKFhD6XNtARrD::U5KVhmRyPF
call System.Byte[] CSHyGqVKFhD6XNtARrD::OYkVl7E5cr(CSHyGqVKFhD6XNtARrD)
ldsfld owVjjGVQwQ1FkAsM1db owVjjGVQwQ1FkAsM1db::QLlVvKx7JN
call System.Void owVjjGVQwQ1FkAsM1db::OYkVl7E5cr(System.Object,System.Byte[],owVjjGVQwQ1FkAsM1db)
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_1fcd2059c26e4094a9f5be5f5c4f80b5
brfalse IL_00AC: switch(IL_00C8)
pop <null>
ldc.i4 0
br IL_00AC: switch(IL_00C8)
br IL_00A8: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00A8: ldloc V_0
br IL_00C8: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_d05baa314b38460099db6c1e8f34a088
brfalse IL_00FF: switch(IL_011B)
pop <null>
ldc.i4 0
br IL_00FF: switch(IL_011B)
br IL_00FB: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00FB: ldloc V_2
br IL_011B: leave IL_013F
leave IL_013F: ret
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_e65fb5c3028a4616ab9d4c56af4e71b2
brtrue IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
ret <null>
Module Name
Lzlnrkkygd.exe
Full Name
Lzlnrkkygd.exe
EntryPoint
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Scope Name
Lzlnrkkygd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Lzlnrkkygd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void fWsYDCkUtrBEQeEbHB.RVLyJdmmrxrduM8XUU::wHicbu88N()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
ldsfld TCue3FVe0uOFaBgKYs6 TCue3FVe0uOFaBgKYs6::o8EV2CyiKn
call System.Void TCue3FVe0uOFaBgKYs6::OYkVl7E5cr(TCue3FVe0uOFaBgKYs6)
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_04da7b53e56045198e7ab1656db665fc
brfalse IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
nop <null>
newobj System.Void SCIyVFBEjNJD9sRIN3.N9Ev6fuFJXrk1WHQaM::.ctor()
ldsfld CSHyGqVKFhD6XNtARrD CSHyGqVKFhD6XNtARrD::U5KVhmRyPF
call System.Byte[] CSHyGqVKFhD6XNtARrD::OYkVl7E5cr(CSHyGqVKFhD6XNtARrD)
ldsfld owVjjGVQwQ1FkAsM1db owVjjGVQwQ1FkAsM1db::QLlVvKx7JN
call System.Void owVjjGVQwQ1FkAsM1db::OYkVl7E5cr(System.Object,System.Byte[],owVjjGVQwQ1FkAsM1db)
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_1fcd2059c26e4094a9f5be5f5c4f80b5
brfalse IL_00AC: switch(IL_00C8)
pop <null>
ldc.i4 0
br IL_00AC: switch(IL_00C8)
br IL_00A8: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00A8: ldloc V_0
br IL_00C8: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 5
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_d05baa314b38460099db6c1e8f34a088
brfalse IL_00FF: switch(IL_011B)
pop <null>
ldc.i4 0
br IL_00FF: switch(IL_011B)
br IL_00FB: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00FB: ldloc V_2
br IL_011B: leave IL_013F
leave IL_013F: ret
ldc.i4 1
ldsfld <Module>{b819200e-98f6-4daa-943b-1b1eddc18956} <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_f42df46bab464c0289a6bb003acaa011
ldfld System.Int32 <Module>{b819200e-98f6-4daa-943b-1b1eddc18956}::m_e65fb5c3028a4616ab9d4c56af4e71b2
brtrue IL_0014: switch(IL_013F,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_013F,IL_0061,IL_0038)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙