Malicious
Malicious

MsSurrogateProvidersaves.exe

PE Executable
MD5: 0979b3bd68e2bae0b3a8045219380335
Size: 12.15 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
12.15 MB · 12,146,176 B
First seen
2026-08-26 15:45 · 2 months ago
Last seen
2026-08-26 15:45 · 2 months ago
Last analysis
2026-08-26 15:45 · 2 months ago
Hashes
MD5 0979b3bd68e2bae0b3a8045219380335 Sha1 a820087f17519b60c9af0e167e9ef3364cc4aed9 Sha256 be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e Sha384 cfe81ba4d04c8bc4d8a4d0df6cde96d93e220c14622b13c2eab3616a7c2628505f13c763616cead136eb689cb348afac Sha512 56a9f1fcf39690a88aee9f163edfe95441c327e59c1364b0b8eb221c11cf0f95dcf3dbb01d567176c1eb475af1822811a9debecdfe70347ac479a3fdaebbd4a9 SSDeep 98304:Ll2X8KwwfxwNjtkTwpPK++tAZ/Fza/JmUMMJ06:Ll2sKwOK8cpyjtAN6Ap TLSH D2C6F14697628E33C2AA3B7184D7001E46B0C7627522FF1B763F18E1AC4A3719F569F6
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXE0979b3bd68e2bae0b3a8045219380335
Structure
BINOverlay_37a4a273.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINr75342jHhdqht5hPFI.hWvsalLt2htvBrMWYp
BINu9V6ikwXVXTUVHHXpl.Eyw7WLJSc00BLUwDTj
BINk677u8VaRl8OASYr3X.x4ueJMWIyhgfWNpEWB
BINvJDsD99KD9NqAyL5Nt.KFednafZBKrcZNCG7F
BINJePRQbh5Qe4ku3civv.qplBu7gFguXyfSr44i
BIN3ZaGHaROc3gHjwfacx.v3VJwOGBhPdUA8R3RE
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
Overlay extracted: Overlay_37a4a273.bin (8360960 bytes)
Module Name
2XbSsyTLSn8BDTWS9i25PM
Full Name
2XbSsyTLSn8BDTWS9i25PM
EntryPoint
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Scope Name
2XbSsyTLSn8BDTWS9i25PM
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sOrPtR
Assembly Version
5.9.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Main IL Instruction Count
92
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0127: ldnull
ldarg.0 <null>
ldlen <null>
brfalse IL_0127: ldnull
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldarg.0 <null>
brfalse IL_0127: ldnull
ldc.i4 5
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_02ccfacb49894fce818880656ea6bdbb
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
call System.Void PRIWlZ1kGoncPSNMQBC.Ehv5Kg1oeA8qvdNuJni::u7PGVlV8I7H()
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_d95da5f0029d425599dfbb1f89d76548
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
newobj System.Void mHwykyGx67vwhDf4Yt8.UuQ75iG89PTALEccEAY::.ctor()
pop <null>
ldc.i4 6
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f6ba0ad4704f493b9ab7e889ebed2f24
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 6
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
ret <null>
nop <null>
ldc.i4 1620476504
ldc.i4 1935167674
xor <null>
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_0803a0dd6f71434580f74c48079869ea
xor <null>
call System.String en6O475o3pLkgQKKEM2.vuv6dR56Vik3M45JIPg::XYV53B7ubA(System.Int32)
newobj System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::.ctor(System.String)
call System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::FBv9gCRCrC()
ldc.i4 4
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_7ac018f96236464ab4c20d29dba1a48d
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
br IL_0132: ldarg.0
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_fef2792a78da43f5a04473e5aa4a4a5e
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldnull <null>
br IL_0135: ldarg.0
br IL_0132: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_0144: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bgt IL_014A: ldarg.0
ldnull <null>
br IL_014D: newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
call System.Void BwZCgvGvXkvubMjxDrf.NP5ZfEGNIYdQxm1ouwB::jVSG6vithu(wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk)
ldc.i4 7
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f26a77f0a10f4681bb6ad7063dbc40b5
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 7
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
Module Name
2XbSsyTLSn8BDTWS9i25PM
Full Name
2XbSsyTLSn8BDTWS9i25PM
EntryPoint
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Scope Name
2XbSsyTLSn8BDTWS9i25PM
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sOrPtR
Assembly Version
5.9.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Main IL Instruction Count
92
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0127: ldnull
ldarg.0 <null>
ldlen <null>
brfalse IL_0127: ldnull
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldarg.0 <null>
brfalse IL_0127: ldnull
ldc.i4 5
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_02ccfacb49894fce818880656ea6bdbb
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
call System.Void PRIWlZ1kGoncPSNMQBC.Ehv5Kg1oeA8qvdNuJni::u7PGVlV8I7H()
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_d95da5f0029d425599dfbb1f89d76548
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
newobj System.Void mHwykyGx67vwhDf4Yt8.UuQ75iG89PTALEccEAY::.ctor()
pop <null>
ldc.i4 6
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f6ba0ad4704f493b9ab7e889ebed2f24
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 6
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
ret <null>
nop <null>
ldc.i4 1620476504
ldc.i4 1935167674
xor <null>
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_0803a0dd6f71434580f74c48079869ea
xor <null>
call System.String en6O475o3pLkgQKKEM2.vuv6dR56Vik3M45JIPg::XYV53B7ubA(System.Int32)
newobj System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::.ctor(System.String)
call System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::FBv9gCRCrC()
ldc.i4 4
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_7ac018f96236464ab4c20d29dba1a48d
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
br IL_0132: ldarg.0
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_fef2792a78da43f5a04473e5aa4a4a5e
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldnull <null>
br IL_0135: ldarg.0
br IL_0132: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_0144: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bgt IL_014A: ldarg.0
ldnull <null>
br IL_014D: newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
call System.Void BwZCgvGvXkvubMjxDrf.NP5ZfEGNIYdQxm1ouwB::jVSG6vithu(wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk)
ldc.i4 7
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f26a77f0a10f4681bb6ad7063dbc40b5
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 7
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
1 malicious · 9 files
EXE0979b3bd68e2bae0b3a8045219380335
Structure
BINOverlay_37a4a273.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙