Malicious
Malicious

0499926eb64156d707e5ebf93e2cb91b

PE Executable
MD5: 0499926eb64156d707e5ebf93e2cb91b
Size: 425.47 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0499926eb64156d707e5ebf93e2cb91b
Sha1 c9521a13733fca70bf4f85941a730e2a4da77877
Sha256 5f1a3507e06e5c238cec9070f5e408e76ad4c8b0d485d445cd40e46f563b73ff
Sha384 feaf5a0f2099b88642e10ec45602ab4b73569be1d5d3f548354b0bcbec828357c998f8a9cbcf1a58091624fdc3e7bd4a
Sha512 2869a330622fd14dce2300e6b45548a62289ad53267c60615bdf5d11bb608fc230c8d1cfa8b2b50f7e32e5c7430421a640436fd0e3cee4fa7857503aad71a984
SSDeep 6144:7RryZFr9fSIp7XeUK/Gb3sPRrc2xkTzbeK2:9yZ95rHKY8Rrc2xAzbe
TLSH 50944C3B76914F21C14A4772C1C7490087D6568776ABFB0F728913D61E873EFDA0A2AB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0499926eb64156d707e5ebf93e2cb91b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ejZENq1fyXYrn5YhkW.BFCCxi8f5RA4TsJTd1
6lDtAeJcUQLa0SPWLL.APDGoCLc1myNuM78GU
bKO5oss8c9CY7BWal1.TXoS1uldwHlSKpESQb
33xnDeVxrgY3Aiep8p.dGqJapP43HAL0LC1Os
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Vubyvjusjjr.exe
Full Name
Vubyvjusjjr.exe
EntryPoint
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Scope Name
Vubyvjusjjr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vubyvjusjjr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld Jx1AbL4soIx7Vfm82ei Jx1AbL4soIx7Vfm82ei::Qg14lXDEWp
call System.Void Jx1AbL4soIx7Vfm82ei::CIX4KSv9tc(Jx1AbL4soIx7Vfm82ei)
ldc.i4 0
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_1ed55c4db3544d13b66ed7b6698ab8b2
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld vQMemj4J6FRl9DAZOqr vQMemj4J6FRl9DAZOqr::bS24LcBmxr
call System.Byte[] vQMemj4J6FRl9DAZOqr::CIX4KSv9tc(vQMemj4J6FRl9DAZOqr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_66563cbed5a64a54a9606c3134f3e080
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014A: leave IL_0038
ldc.i4 1214613490
ldc.i4 6
shr <null>
ldc.i4 430579565
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_af8483d32eb8455b8b2830a29a873eed
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
ldc.i4 603493145
ldc.i4 1641232225
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5a32a5d9ad5e475384f86bc6202e1f3d
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
newobj System.Void wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nNjjpm4EcgaeVoVeiCp nNjjpm4EcgaeVoVeiCp::yuy4AQ8oRL
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL nNjjpm4EcgaeVoVeiCp::CIX4KSv9tc(System.Object,System.Byte[],nNjjpm4EcgaeVoVeiCp)
ldsfld NItbZu4kF6KXbSSnxLx NItbZu4kF6KXbSSnxLx::NxM4m9l8vQ
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL NItbZu4kF6KXbSSnxLx::CIX4KSv9tc(System.Object,NItbZu4kF6KXbSSnxLx)
ldsfld DrdCkj4M1IB9kkHJAao DrdCkj4M1IB9kkHJAao::XDd47Jh1PR
call System.Void DrdCkj4M1IB9kkHJAao::CIX4KSv9tc(System.Object,DrdCkj4M1IB9kkHJAao)
ldc.i4 5
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_23ee2476b5a849119b95111535efc141
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_681f1192a2024d75aa513a59edfb785c
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_017D: ldloc V_0
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_ac323a1eb6864d73b0416baa02827bb3
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Vubyvjusjjr.exe
Full Name
Vubyvjusjjr.exe
EntryPoint
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Scope Name
Vubyvjusjjr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vubyvjusjjr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld Jx1AbL4soIx7Vfm82ei Jx1AbL4soIx7Vfm82ei::Qg14lXDEWp
call System.Void Jx1AbL4soIx7Vfm82ei::CIX4KSv9tc(Jx1AbL4soIx7Vfm82ei)
ldc.i4 0
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_1ed55c4db3544d13b66ed7b6698ab8b2
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld vQMemj4J6FRl9DAZOqr vQMemj4J6FRl9DAZOqr::bS24LcBmxr
call System.Byte[] vQMemj4J6FRl9DAZOqr::CIX4KSv9tc(vQMemj4J6FRl9DAZOqr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_66563cbed5a64a54a9606c3134f3e080
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014A: leave IL_0038
ldc.i4 1214613490
ldc.i4 6
shr <null>
ldc.i4 430579565
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_af8483d32eb8455b8b2830a29a873eed
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
ldc.i4 603493145
ldc.i4 1641232225
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5a32a5d9ad5e475384f86bc6202e1f3d
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
newobj System.Void wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nNjjpm4EcgaeVoVeiCp nNjjpm4EcgaeVoVeiCp::yuy4AQ8oRL
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL nNjjpm4EcgaeVoVeiCp::CIX4KSv9tc(System.Object,System.Byte[],nNjjpm4EcgaeVoVeiCp)
ldsfld NItbZu4kF6KXbSSnxLx NItbZu4kF6KXbSSnxLx::NxM4m9l8vQ
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL NItbZu4kF6KXbSSnxLx::CIX4KSv9tc(System.Object,NItbZu4kF6KXbSSnxLx)
ldsfld DrdCkj4M1IB9kkHJAao DrdCkj4M1IB9kkHJAao::XDd47Jh1PR
call System.Void DrdCkj4M1IB9kkHJAao::CIX4KSv9tc(System.Object,DrdCkj4M1IB9kkHJAao)
ldc.i4 5
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_23ee2476b5a849119b95111535efc141
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_681f1192a2024d75aa513a59edfb785c
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_017D: ldloc V_0
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_ac323a1eb6864d73b0416baa02827bb3
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
0499926eb64156d707e5ebf93e2cb91b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ejZENq1fyXYrn5YhkW.BFCCxi8f5RA4TsJTd1
6lDtAeJcUQLa0SPWLL.APDGoCLc1myNuM78GU
bKO5oss8c9CY7BWal1.TXoS1uldwHlSKpESQb
33xnDeVxrgY3Aiep8p.dGqJapP43HAL0LC1Os
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙