07e8b25002b5269c568989f4bdf4b662

PE Executable

MD5: 07e8b25002b5269c568989f4bdf4b662

Size: 1.07 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	07e8b25002b5269c568989f4bdf4b662
Sha1	3629460af81767ba1c2a0d5c293b4c7096a8cfff
Sha256	198659cc46b0cccf45c63324d3f25192095757a7df2ab6bb2e28e74f1d8d2dd4
Sha384	407184f81c2e11306a8b41d33c5ac16acd523188621056b3fadd77c772c54afdb3fe7b38dd5797242b6ad3960e747696
Sha512	1907974c9508abb8137d78cb54bb8f0f3adc0f99b0aa2a8843827236c9eb7e52ff11c5e554c4ef8def0e4962b9d806398483f6de445a719848afafc6491b4cbe
SSDeep	24576:dL7jJGMorgIT7H2A5b9M7XmLROs4ZKTj7NQ:VJHigIT7l+7KROssAq
TLSH	2935CF2636654E61C2850B73D1DBA50083A29A86BAE3F30FF14523E51D433FFDA4B697

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Ekewecc.exe
Full Name	Ekewecc.exe
EntryPoint	System.Void cjfgG6efqohRtuhR8e.GEd7ePR5NBGK3I8ysm::h1DUZffZd()
Scope Name	Ekewecc.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ekewecc
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void cjfgG6efqohRtuhR8e.GEd7ePR5NBGK3I8ysm::h1DUZffZd()
Main IL Instruction Count	94
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_0010: ldloc V_2 br IL_0038: ret ret <null> nop <null> ldsfld S8OXpXR1X8pC0jXn1Rk S8OXpXR1X8pC0jXn1Rk::XtxR0dLyJg call System.Byte[] S8OXpXR1X8pC0jXn1Rk::csZRnZm732(S8OXpXR1X8pC0jXn1Rk) stloc.s V_0 ldc.i4 0 ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_817962b993ef4462974a7884b8fc341d brtrue IL_0077: switch(IL_0097,IL_010C) pop <null> ldc.i4 2 br IL_0077: switch(IL_0097,IL_010C) br IL_0073: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0073: ldloc V_1 br IL_0097: ldc.i4 -1217065196 ldc.i4 -1217065196 ldc.i4 -1415782516 xor <null> ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_72039be1bf65468992ea2381bdd9483c xor <null> ldsfld v95T4PRC3uHlInuplc0 v95T4PRC3uHlInuplc0::VJ7Rlv5FAx call System.String v95T4PRC3uHlInuplc0::csZRnZm732(System.Int32,v95T4PRC3uHlInuplc0) ldc.i4 162510348 ldc.i4 329984458 xor <null> ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_256a9f996f1d49c7a513b15d40b0405a xor <null> ldsfld v95T4PRC3uHlInuplc0 v95T4PRC3uHlInuplc0::VJ7Rlv5FAx call System.String v95T4PRC3uHlInuplc0::csZRnZm732(System.Int32,v95T4PRC3uHlInuplc0) newobj System.Void XR4KebaMLr4ulKYAlX.SQwIgSV9hRG0E07RqL::.ctor(System.String,System.String) newobj System.Void cxvZ81idlSQeIY8AW7j.gpbbpkiQWcagYKYis8u::.ctor(XR4KebaMLr4ulKYAlX.SQwIgSV9hRG0E07RqL) ldloc.s V_0 ldsfld bNb2tgRP8MUOUy3G72F bNb2tgRP8MUOUy3G72F::vEvRzRK2Kw call System.Void bNb2tgRP8MUOUy3G72F::csZRnZm732(System.Object,System.Byte[],bNb2tgRP8MUOUy3G72F) ldc.i4 1 ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_1f71ca8318d94062a32d16c2ce46f321 brtrue IL_0077: switch(IL_0097,IL_010C) pop <null> ldc.i4 1 br IL_0077: switch(IL_0097,IL_010C) leave IL_0038: ret pop <null> ldc.i4 0 ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_5a11e61711874681bb88719ef3f0e12c brtrue IL_0143: switch(IL_015F) pop <null> ldc.i4 3 br IL_0143: switch(IL_015F) br IL_013F: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 988 beq IL_013F: ldloc V_3 br IL_015F: leave IL_0038 leave IL_0038: ret ldc.i4 2 ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_e691a2c08534453bb7dc79be79733dac brtrue IL_0014: switch(IL_0039,IL_0183,IL_0038) pop <null> ldc.i4 4 br IL_0014: switch(IL_0039,IL_0183,IL_0038) ldsfld VLlWR2RDNkLrEXxlGUK VLlWR2RDNkLrEXxlGUK::pucRoUVwq1 call System.Void VLlWR2RDNkLrEXxlGUK::csZRnZm732(VLlWR2RDNkLrEXxlGUK) ldc.i4 5 ldsfld <Module>{9af206cc-b16c-4914-a2db-14f093107b42} <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_fd237ccca2ff42cb99e809a43aafa00d ldfld System.Int32 <Module>{9af206cc-b16c-4914-a2db-14f093107b42}::m_21437fb4ffec4055ba59097e1f576083 brtrue IL_0014: switch(IL_0039,IL_0183,IL_0038) pop <null> ldc.i4 0 br IL_0014: switch(IL_0039,IL_0183,IL_0038)

No malware configuration was found at this point.

You must be signed in to view YARA rules.