Malicious
Malicious

05e27e1a0ed75c32e896c5d0261bb077

Share on LinkedIn
Print
PE Executable
MD5: 05e27e1a0ed75c32e896c5d0261bb077
Size: 430.59 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 05e27e1a0ed75c32e896c5d0261bb077
Sha1 6624eb2d2637338c82b5325141f1f75179a74660
Sha256 af4ee79582992e348a8739579da478d50daccbaa6ec97420311916a2ac0fc503
Sha384 63ab2c819c7201eb692b5591f71bacf362b84c336444b8dd75fae169c49db5f1e4ad1fbf11374bf14a6677b4ba3b9370
Sha512 be9b7c2bd4623174ca14388245759525dcc545ee839d7220d0e96e52de1740dbd079d329d47feb97051d1126e25ff17a20c6a0b7fa10e6850fe7a59b864a97a0
SSDeep 6144:asgj4lZOQdJg8GVMxluQZBGMIUiSavngkiy/CraY:aFs5C1SukB65Sg5iACR
TLSH 91944B6A72914F21C24A1B73C1C7890487EA568B36E7F70B328513D71D863FEDE4A297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
05e27e1a0ed75c32e896c5d0261bb077
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VHeAaQflQvKh2IkxWk.BXyw2pWKUtFukSDJfD
Vsii2G7g2ybYLRp0Po.Pdm7sy2lqtPNYABIgQ
OMLXNOTPKNYiDxEX25.15QfTENx9bYjyJMh8D
dJCwu4Hvx5aQGavZZD.ZhyYo9b6VwlW29mLna
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Sprdkxl.exe
Full Name
Sprdkxl.exe
EntryPoint
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Scope Name
Sprdkxl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sprdkxl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0199: ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
ret <null>
nop <null>
ldsfld oSZuX5efGBVhGowUVTr oSZuX5efGBVhGowUVTr::BiDeWAT4iH
call System.Byte[] oSZuX5efGBVhGowUVTr::awte89JUfK(oSZuX5efGBVhGowUVTr)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_a8742076b08f463a864e28bb58dcfe24
brfalse IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0122,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1668649463
ldc.i4 -1668649463
ldc.i4 6
shl <null>
ldc.i4 1028729401
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_c8bfd11112414522a2cd4fe680ee9e8b
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
ldc.i4 -980557257
neg <null>
ldc.i4 1462701809
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
newobj System.Void DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld FQJA0NesIS105FdfxNb FQJA0NesIS105FdfxNb::Ft9ev5swps
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU FQJA0NesIS105FdfxNb::awte89JUfK(System.Object,System.Byte[],FQJA0NesIS105FdfxNb)
ldsfld MK7ZPoe4IPVwrNbcwrF MK7ZPoe4IPVwrNbcwrF::UM2e6Mxg5s
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU MK7ZPoe4IPVwrNbcwrF::awte89JUfK(System.Object,MK7ZPoe4IPVwrNbcwrF)
ldsfld y73BbOeVrUdBkoQ0siN y73BbOeVrUdBkoQ0siN::DUTeoBE0dG
call System.Void y73BbOeVrUdBkoQ0siN::awte89JUfK(System.Object,y73BbOeVrUdBkoQ0siN)
ldc.i4 1
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_5d265944bdb440929966d749087344a3
brtrue IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0122,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_236ae9e2d06d48649436ab8cdea39fdf
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 1
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0155: ldloc V_1
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_8128249d740a4f8894c07fce3e706733
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
call System.Void usBnHgeThgPsD49aboE::awte89JUfK(usBnHgeThgPsD49aboE)
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
Module Name
Sprdkxl.exe
Full Name
Sprdkxl.exe
EntryPoint
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Scope Name
Sprdkxl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sprdkxl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uaEA8V3fQOCJPlbhOO.oI4Y7geJMpp6lXWARm::YfRs4QP3S()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0199: ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
ret <null>
nop <null>
ldsfld oSZuX5efGBVhGowUVTr oSZuX5efGBVhGowUVTr::BiDeWAT4iH
call System.Byte[] oSZuX5efGBVhGowUVTr::awte89JUfK(oSZuX5efGBVhGowUVTr)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_a8742076b08f463a864e28bb58dcfe24
brfalse IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0122,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1668649463
ldc.i4 -1668649463
ldc.i4 6
shl <null>
ldc.i4 1028729401
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_c8bfd11112414522a2cd4fe680ee9e8b
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
ldc.i4 -980557257
neg <null>
ldc.i4 1462701809
xor <null>
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
xor <null>
ldsfld QhTqy0eedeYqOcApyIj QhTqy0eedeYqOcApyIj::kTWe30a26L
call System.String QhTqy0eedeYqOcApyIj::awte89JUfK(System.Int32,QhTqy0eedeYqOcApyIj)
newobj System.Void DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld FQJA0NesIS105FdfxNb FQJA0NesIS105FdfxNb::Ft9ev5swps
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU FQJA0NesIS105FdfxNb::awte89JUfK(System.Object,System.Byte[],FQJA0NesIS105FdfxNb)
ldsfld MK7ZPoe4IPVwrNbcwrF MK7ZPoe4IPVwrNbcwrF::UM2e6Mxg5s
call DcuT6wHFWL5NNkmu68H.eA6osQH8WCHj0nL5jdU MK7ZPoe4IPVwrNbcwrF::awte89JUfK(System.Object,MK7ZPoe4IPVwrNbcwrF)
ldsfld y73BbOeVrUdBkoQ0siN y73BbOeVrUdBkoQ0siN::DUTeoBE0dG
call System.Void y73BbOeVrUdBkoQ0siN::awte89JUfK(System.Object,y73BbOeVrUdBkoQ0siN)
ldc.i4 1
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_5d265944bdb440929966d749087344a3
brtrue IL_0077: switch(IL_0122,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0122,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_236ae9e2d06d48649436ab8cdea39fdf
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 1
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0155: ldloc V_1
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_8128249d740a4f8894c07fce3e706733
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld usBnHgeThgPsD49aboE usBnHgeThgPsD49aboE::zRWeNJQqiR
call System.Void usBnHgeThgPsD49aboE::awte89JUfK(usBnHgeThgPsD49aboE)
ldc.i4 0
ldsfld <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7} <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_463fb799f1e14d059aa8445b428e2e93
ldfld System.Int32 <Module>{3275ba1f-a064-4c1b-a4f6-e461f5a73fc7}::m_2bb439b60a7a42b885c82198f21c3644
brtrue IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙