Deep Malware Analysis of 08945686ad13debd912ad29a63cb8e2c | md5: 08945686ad13debd912ad29a63cb8e2c | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.90

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	08945686ad13debd912ad29a63cb8e2c
Sha1	46788e3ea9f4b2038e1448244c41ec369496754d
Sha256	2500305d3a21671212f9d98de0d4750cdda70afa6f55b4ea3f141932c2b9338f
Sha384	4c5bf837cc469a5e91e6bfd8596ed3afadbe7cadb3684655cb79941183e60b1b9c4b3bfa8147a42049a36b2a58f3612e
Sha512	a95985fbb20d9960291bb708a449a6806d2c8d6a796367d9740e638a1f5290ea6187a3dbdf272414fb69b48876ea9be82db7225455af2bc09610d57435a96dcd
SSDeep	24576:85p82Sfb0A5iNQv2lQuNHsv5baICLpLTQq5dSo3y+so:8/WNJQyhbaIyTDgo3m
TLSH	F2455B017E44CE92F0191673C1DF820847B4AD516AE6E72BBDAA337E55123A77C0E9CB

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	7wo5S4UvJbj7HW7
Full Name	7wo5S4UvJbj7HW7
EntryPoint	System.Void fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::nSaENKXCwP()
Scope Name	7wo5S4UvJbj7HW7
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	qg5Fk0Aj
Assembly Version	0.6.3.4
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::nSaENKXCwP()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void vXBufZEqOfLsmM4InTx.IiA9MNEJ7PXuN5qH13A::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::MlbEQ68tlq callvirt System.Void EZ6cuLnJeU0na01ylNk.ALNHnun3RM1X9Eaq14l::LRO1HnBgEu() nop <null> ret <null>`
Module Name	7wo5S4UvJbj7HW7
Full Name	7wo5S4UvJbj7HW7
EntryPoint	System.Void fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::nSaENKXCwP()
Scope Name	7wo5S4UvJbj7HW7
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	qg5Fk0Aj
Assembly Version	0.6.3.4
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::nSaENKXCwP()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void vXBufZEqOfLsmM4InTx.IiA9MNEJ7PXuN5qH13A::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object fm9L2MnRtBCqHPWSYRi.nbCReunGAeGMiSQFij4::MlbEQ68tlq callvirt System.Void EZ6cuLnJeU0na01ylNk.ALNHnun3RM1X9Eaq14l::LRO1HnBgEu() nop <null> ret <null>`