Malicious
Malicious

05e27e1a0ed75c32e896c5d0261bb077

PE Executable
MD5: 05e27e1a0ed75c32e896c5d0261bb077
Size: 430.59 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 05e27e1a0ed75c32e896c5d0261bb077
Sha1 6624eb2d2637338c82b5325141f1f75179a74660
Sha256 af4ee79582992e348a8739579da478d50daccbaa6ec97420311916a2ac0fc503
Sha384 63ab2c819c7201eb692b5591f71bacf362b84c336444b8dd75fae169c49db5f1e4ad1fbf11374bf14a6677b4ba3b9370
Sha512 be9b7c2bd4623174ca14388245759525dcc545ee839d7220d0e96e52de1740dbd079d329d47feb97051d1126e25ff17a20c6a0b7fa10e6850fe7a59b864a97a0
SSDeep 6144:asgj4lZOQdJg8GVMxluQZBGMIUiSavngkiy/CraY:aFs5C1SukB65Sg5iACR
TLSH 91944B6A72914F21C24A1B73C1C7890487EA568B36E7F70B328513D71D863FEDE4A297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
05e27e1a0ed75c32e896c5d0261bb077
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VHeAaQflQvKh2IkxWk.BXyw2pWKUtFukSDJfD
Vsii2G7g2ybYLRp0Po.Pdm7sy2lqtPNYABIgQ
OMLXNOTPKNYiDxEX25.15QfTENx9bYjyJMh8D
dJCwu4Hvx5aQGavZZD.ZhyYo9b6VwlW29mLna
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Sprdkxl.exe
Full Name
Sprdkxl.exe
EntryPoint
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Scope Name
Sprdkxl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sprdkxl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0199: ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
ret <null>
nop <null>
ldsfld oSZuX5efGBVhGowUVTr oSZuX5efGBVhGowUVTr::BiDeWAT4iH
call System.Byte[] oSZuX5efGBVhGowUVTr::awte89JUfK(oSZuX5efGBVhGowUVTr)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_a8742076b08f463a864e28bb58dcfe24
brfalse IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0122,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1668649463
ldc.i4 -1668649463
ldc.i4 6
shl <null>
ldc.i4 1028729401
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_c8bfd11112414522a2cd4fe680ee9e8b
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
ldc.i4 -980557257
neg <null>
ldc.i4 1462701809
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
newobj System.Void DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld FQJA0NesIS105FdfxNb FQJA0NesIS105FdfxNb::Ft9ev5swps
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU FQJA0NesIS105FdfxNb::awte89JUfK(System.Object,System.Byte[],FQJA0NesIS105FdfxNb)
ldsfld MK7ZPoe4IPVwrNbcwrF MK7ZPoe4IPVwrNbcwrF::UM2e6Mxg5s
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU MK7ZPoe4IPVwrNbcwrF::awte89JUfK(System.Object,MK7ZPoe4IPVwrNbcwrF)
ldsfld y73BbOeVrUdBkoQ0siN y73BbOeVrUdBkoQ0siN::DUTeoBE0dG
call System.Void y73BbOeVrUdBkoQ0siN::awte89JUfK(System.Object,y73BbOeVrUdBkoQ0siN)
ldc.i4 1
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_5d265944bdb440929966d749087344a3
brtrue IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0122,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_236ae9e2d06d48649436ab8cdea39fdf
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 1
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0155: ldloc V_1
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_8128249d740a4f8894c07fce3e706733
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
call System.Void usBnHgeThgPsD49aboE::awte89JUfK(usBnHgeThgPsD49aboE)
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
Module Name
Sprdkxl.exe
Full Name
Sprdkxl.exe
EntryPoint
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Scope Name
Sprdkxl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sprdkxl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0199: ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
ret <null>
nop <null>
ldsfld oSZuX5efGBVhGowUVTr oSZuX5efGBVhGowUVTr::BiDeWAT4iH
call System.Byte[] oSZuX5efGBVhGowUVTr::awte89JUfK(oSZuX5efGBVhGowUVTr)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_a8742076b08f463a864e28bb58dcfe24
brfalse IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0122,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1668649463
ldc.i4 -1668649463
ldc.i4 6
shl <null>
ldc.i4 1028729401
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_c8bfd11112414522a2cd4fe680ee9e8b
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
ldc.i4 -980557257
neg <null>
ldc.i4 1462701809
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
newobj System.Void DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld FQJA0NesIS105FdfxNb FQJA0NesIS105FdfxNb::Ft9ev5swps
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU FQJA0NesIS105FdfxNb::awte89JUfK(System.Object,System.Byte[],FQJA0NesIS105FdfxNb)
ldsfld MK7ZPoe4IPVwrNbcwrF MK7ZPoe4IPVwrNbcwrF::UM2e6Mxg5s
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU MK7ZPoe4IPVwrNbcwrF::awte89JUfK(System.Object,MK7ZPoe4IPVwrNbcwrF)
ldsfld y73BbOeVrUdBkoQ0siN y73BbOeVrUdBkoQ0siN::DUTeoBE0dG
call System.Void y73BbOeVrUdBkoQ0siN::awte89JUfK(System.Object,y73BbOeVrUdBkoQ0siN)
ldc.i4 1
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_5d265944bdb440929966d749087344a3
brtrue IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0122,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_236ae9e2d06d48649436ab8cdea39fdf
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 1
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0155: ldloc V_1
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_8128249d740a4f8894c07fce3e706733
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
call System.Void usBnHgeThgPsD49aboE::awte89JUfK(usBnHgeThgPsD49aboE)
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
05e27e1a0ed75c32e896c5d0261bb077
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VHeAaQflQvKh2IkxWk.BXyw2pWKUtFukSDJfD
Vsii2G7g2ybYLRp0Po.Pdm7sy2lqtPNYABIgQ
OMLXNOTPKNYiDxEX25.15QfTENx9bYjyJMh8D
dJCwu4Hvx5aQGavZZD.ZhyYo9b6VwlW29mLna
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙