Malicious
Malicious

0499926eb64156d707e5ebf93e2cb91b

Share on LinkedIn
Print
PE Executable
MD5: 0499926eb64156d707e5ebf93e2cb91b
Size: 425.47 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0499926eb64156d707e5ebf93e2cb91b
Sha1 c9521a13733fca70bf4f85941a730e2a4da77877
Sha256 5f1a3507e06e5c238cec9070f5e408e76ad4c8b0d485d445cd40e46f563b73ff
Sha384 feaf5a0f2099b88642e10ec45602ab4b73569be1d5d3f548354b0bcbec828357c998f8a9cbcf1a58091624fdc3e7bd4a
Sha512 2869a330622fd14dce2300e6b45548a62289ad53267c60615bdf5d11bb608fc230c8d1cfa8b2b50f7e32e5c7430421a640436fd0e3cee4fa7857503aad71a984
SSDeep 6144:7RryZFr9fSIp7XeUK/Gb3sPRrc2xkTzbeK2:9yZ95rHKY8Rrc2xAzbe
TLSH 50944C3B76914F21C14A4772C1C7490087D6568776ABFB0F728913D61E873EFDA0A2AB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0499926eb64156d707e5ebf93e2cb91b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ejZENq1fyXYrn5YhkW.BFCCxi8f5RA4TsJTd1
6lDtAeJcUQLa0SPWLL.APDGoCLc1myNuM78GU
bKO5oss8c9CY7BWal1.TXoS1uldwHlSKpESQb
33xnDeVxrgY3Aiep8p.dGqJapP43HAL0LC1Os
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Vubyvjusjjr.exe
Full Name
Vubyvjusjjr.exe
EntryPoint
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Scope Name
Vubyvjusjjr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vubyvjusjjr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld Jx1AbL4soIx7Vfm82ei Jx1AbL4soIx7Vfm82ei::Qg14lXDEWp
call System.Void Jx1AbL4soIx7Vfm82ei::CIX4KSv9tc(Jx1AbL4soIx7Vfm82ei)
ldc.i4 0
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_1ed55c4db3544d13b66ed7b6698ab8b2
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld vQMemj4J6FRl9DAZOqr vQMemj4J6FRl9DAZOqr::bS24LcBmxr
call System.Byte[] vQMemj4J6FRl9DAZOqr::CIX4KSv9tc(vQMemj4J6FRl9DAZOqr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_66563cbed5a64a54a9606c3134f3e080
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014A: leave IL_0038
ldc.i4 1214613490
ldc.i4 6
shr <null>
ldc.i4 430579565
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_af8483d32eb8455b8b2830a29a873eed
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
ldc.i4 603493145
ldc.i4 1641232225
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5a32a5d9ad5e475384f86bc6202e1f3d
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
newobj System.Void wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nNjjpm4EcgaeVoVeiCp nNjjpm4EcgaeVoVeiCp::yuy4AQ8oRL
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL nNjjpm4EcgaeVoVeiCp::CIX4KSv9tc(System.Object,System.Byte[],nNjjpm4EcgaeVoVeiCp)
ldsfld NItbZu4kF6KXbSSnxLx NItbZu4kF6KXbSSnxLx::NxM4m9l8vQ
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL NItbZu4kF6KXbSSnxLx::CIX4KSv9tc(System.Object,NItbZu4kF6KXbSSnxLx)
ldsfld DrdCkj4M1IB9kkHJAao DrdCkj4M1IB9kkHJAao::XDd47Jh1PR
call System.Void DrdCkj4M1IB9kkHJAao::CIX4KSv9tc(System.Object,DrdCkj4M1IB9kkHJAao)
ldc.i4 5
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_23ee2476b5a849119b95111535efc141
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_681f1192a2024d75aa513a59edfb785c
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_017D: ldloc V_0
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_ac323a1eb6864d73b0416baa02827bb3
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Vubyvjusjjr.exe
Full Name
Vubyvjusjjr.exe
EntryPoint
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Scope Name
Vubyvjusjjr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vubyvjusjjr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void CB42qJwoocYu3wdOxU.bMNZfg47pxAMn7nNjI::Qq1EwXp56()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld Jx1AbL4soIx7Vfm82ei Jx1AbL4soIx7Vfm82ei::Qg14lXDEWp
call System.Void Jx1AbL4soIx7Vfm82ei::CIX4KSv9tc(Jx1AbL4soIx7Vfm82ei)
ldc.i4 0
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_1ed55c4db3544d13b66ed7b6698ab8b2
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld vQMemj4J6FRl9DAZOqr vQMemj4J6FRl9DAZOqr::bS24LcBmxr
call System.Byte[] vQMemj4J6FRl9DAZOqr::CIX4KSv9tc(vQMemj4J6FRl9DAZOqr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_66563cbed5a64a54a9606c3134f3e080
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014A: leave IL_0038
ldc.i4 1214613490
ldc.i4 6
shr <null>
ldc.i4 430579565
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_af8483d32eb8455b8b2830a29a873eed
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
ldc.i4 603493145
ldc.i4 1641232225
xor <null>
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5a32a5d9ad5e475384f86bc6202e1f3d
xor <null>
ldsfld ef0UOa44mWy08ZtphxQ ef0UOa44mWy08ZtphxQ::vbQ4wbw1Yv
call System.String ef0UOa44mWy08ZtphxQ::CIX4KSv9tc(System.Int32,ef0UOa44mWy08ZtphxQ)
newobj System.Void wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nNjjpm4EcgaeVoVeiCp nNjjpm4EcgaeVoVeiCp::yuy4AQ8oRL
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL nNjjpm4EcgaeVoVeiCp::CIX4KSv9tc(System.Object,System.Byte[],nNjjpm4EcgaeVoVeiCp)
ldsfld NItbZu4kF6KXbSSnxLx NItbZu4kF6KXbSSnxLx::NxM4m9l8vQ
call wPstteVR7J8C0Kj73KM.vcaaeMVKbGaNiiULgRL NItbZu4kF6KXbSSnxLx::CIX4KSv9tc(System.Object,NItbZu4kF6KXbSSnxLx)
ldsfld DrdCkj4M1IB9kkHJAao DrdCkj4M1IB9kkHJAao::XDd47Jh1PR
call System.Void DrdCkj4M1IB9kkHJAao::CIX4KSv9tc(System.Object,DrdCkj4M1IB9kkHJAao)
ldc.i4 5
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_23ee2476b5a849119b95111535efc141
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_681f1192a2024d75aa513a59edfb785c
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_017D: ldloc V_0
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951} <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_5ecff0d56aa2409a80893c9450259371
ldfld System.Int32 <Module>{3e2d9f41-b80e-4c51-8889-c22bed283951}::m_ac323a1eb6864d73b0416baa02827bb3
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙