Malicious
Malicious

08c3a66548259d0589ca348c905ad3ce

Share on LinkedIn
Print
PE Executable
MD5: 08c3a66548259d0589ca348c905ad3ce
Size: 814.08 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 08c3a66548259d0589ca348c905ad3ce
Sha1 977173776f3cd3005d8c6cc21b12e19712196c05
Sha256 f2145437eba0d3bb81c9b7bc905b4cd26a546a8b9a958e5e8ad5c38c0323dcda
Sha384 74cf19bde2904562bb4621aa461c08b64b2dfbf4a6f755a8a7fe1c8f5621f354410c484075dd39c922644dcf0542318c
Sha512 174e4524d1f5c2f5d10469036ce4587531608a62bbab3c69fe94b200b128fa32ee0c7d42a907a2e09d13e559a5801b87f0e322f71080126f1747fa0fc4074cb6
SSDeep 12288:aOLPT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yHC/WchGt/YTtPxW:B2UxAPqGcv/+Duyx4ult/YTC
TLSH 0E05F0294DDB2A25CB7E4E79C1A6089823F0C7279217E72B2EF890F89B537857D17053
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
08c3a66548259d0589ca348c905ad3ce
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
tZf7Rn2iydW48x.Resources.resources
d6ed57f1c2c949.Resources.resources
4efe909b0
[NBF]root.Data
4efe909b1
[NBF]root.Data
4efe909b2
[NBF]root.Data
4efe909b3
[NBF]root.Data
4efe909b4
[NBF]root.Data
4efe909b5
[NBF]root.Data
4efe909b6
[NBF]root.Data
4efe909b7
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
tZf7Rn2iydW48x
Full Name
tZf7Rn2iydW48x
EntryPoint
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Scope Name
tZf7Rn2iydW48x
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tZf7Rn2iydW48x
Assembly Version
16.14.42.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Main IL Instruction Count
67
Main IL 
ldc.i4.1 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean jAs6fo1.0ZnyYs3::Mo8gx6()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.7 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void jAs6fo1.0ZnyYs3::5drMH()
nop <null>
nop <null>
ldc.i8 6
ldc.i4.6 <null>
ldc.i8 5
ldc.i4 1358906416
call System.String Tbe2mS7sA.Kdq8os3R/Mj6fj7Tm.2Axaz::Mi8n6inGEc0ma(System.Int64,System.Int32,System.Int64,System.Int32)
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 25223648
call System.String Mj3cnNa.cb5E7Wnwz2p::3grLE9j(System.Int32,System.Reflection.Assembly,System.Int32)
call System.Void jAs6fo1.0ZnyYs3::me2Z0dJpo3yFXx(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void jAs6fo1.0ZnyYs3::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
pop <null>
ret <null>
Module Name
tZf7Rn2iydW48x
Full Name
tZf7Rn2iydW48x
EntryPoint
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Scope Name
tZf7Rn2iydW48x
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tZf7Rn2iydW48x
Assembly Version
16.14.42.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
Main IL Instruction Count
67
Main IL 
ldc.i4.1 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean jAs6fo1.0ZnyYs3::Mo8gx6()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.7
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.7 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void jAs6fo1.0ZnyYs3::5drMH()
nop <null>
nop <null>
ldc.i8 6
ldc.i4.6 <null>
ldc.i8 5
ldc.i4 1358906416
call System.String Tbe2mS7sA.Kdq8os3R/Mj6fj7Tm.2Axaz::Mi8n6inGEc0ma(System.Int64,System.Int32,System.Int64,System.Int32)
nop <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 25223648
call System.String Mj3cnNa.cb5E7Wnwz2p::3grLE9j(System.Int32,System.Reflection.Assembly,System.Int32)
call System.Void jAs6fo1.0ZnyYs3::me2Z0dJpo3yFXx(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void jAs6fo1.0ZnyYs3::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void jAs6fo1.0ZnyYs3::xHq4zq1TErm()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙