Malicious
Malicious

0979b3bd68e2bae0b3a8045219380335

PE Executable
MD5: 0979b3bd68e2bae0b3a8045219380335
Size: 12.15 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0979b3bd68e2bae0b3a8045219380335
Sha1 a820087f17519b60c9af0e167e9ef3364cc4aed9
Sha256 be45c291ff3fb00e54164f8f4dac8b55d6e9ded30f6112bb508f844ce0ce092e
Sha384 cfe81ba4d04c8bc4d8a4d0df6cde96d93e220c14622b13c2eab3616a7c2628505f13c763616cead136eb689cb348afac
Sha512 56a9f1fcf39690a88aee9f163edfe95441c327e59c1364b0b8eb221c11cf0f95dcf3dbb01d567176c1eb475af1822811a9debecdfe70347ac479a3fdaebbd4a9
SSDeep 98304:Ll2X8KwwfxwNjtkTwpPK++tAZ/Fza/JmUMMJ06:Ll2sKwOK8cpyjtAN6Ap
TLSH D2C6F14697628E33C2AA3B7184D7001E46B0C7627522FF1B763F18E1AC4A3719F569F6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
0979b3bd68e2bae0b3a8045219380335
Malicious
Overlay_37a4a273.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
r75342jHhdqht5hPFI.hWvsalLt2htvBrMWYp
u9V6ikwXVXTUVHHXpl.Eyw7WLJSc00BLUwDTj
k677u8VaRl8OASYr3X.x4ueJMWIyhgfWNpEWB
vJDsD99KD9NqAyL5Nt.KFednafZBKrcZNCG7F
JePRQbh5Qe4ku3civv.qplBu7gFguXyfSr44i
3ZaGHaROc3gHjwfacx.v3VJwOGBhPdUA8R3RE
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_37a4a273.bin (8360960 bytes)
Module Name
2XbSsyTLSn8BDTWS9i25PM
Full Name
2XbSsyTLSn8BDTWS9i25PM
EntryPoint
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Scope Name
2XbSsyTLSn8BDTWS9i25PM
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sOrPtR
Assembly Version
5.9.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Main IL Instruction Count
92
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0127: ldnull
ldarg.0 <null>
ldlen <null>
brfalse IL_0127: ldnull
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldarg.0 <null>
brfalse IL_0127: ldnull
ldc.i4 5
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_02ccfacb49894fce818880656ea6bdbb
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
call System.Void PRIWlZ1kGoncPSNMQBC.Ehv5Kg1oeA8qvdNuJni::u7PGVlV8I7H()
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_d95da5f0029d425599dfbb1f89d76548
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
newobj System.Void mHwykyGx67vwhDf4Yt8.UuQ75iG89PTALEccEAY::.ctor()
pop <null>
ldc.i4 6
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f6ba0ad4704f493b9ab7e889ebed2f24
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 6
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
ret <null>
nop <null>
ldc.i4 1620476504
ldc.i4 1935167674
xor <null>
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_0803a0dd6f71434580f74c48079869ea
xor <null>
call System.String en6O475o3pLkgQKKEM2.vuv6dR56Vik3M45JIPg::XYV53B7ubA(System.Int32)
newobj System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::.ctor(System.String)
call System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::FBv9gCRCrC()
ldc.i4 4
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_7ac018f96236464ab4c20d29dba1a48d
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
br IL_0132: ldarg.0
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_fef2792a78da43f5a04473e5aa4a4a5e
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldnull <null>
br IL_0135: ldarg.0
br IL_0132: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_0144: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bgt IL_014A: ldarg.0
ldnull <null>
br IL_014D: newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
call System.Void BwZCgvGvXkvubMjxDrf.NP5ZfEGNIYdQxm1ouwB::jVSG6vithu(wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk)
ldc.i4 7
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f26a77f0a10f4681bb6ad7063dbc40b5
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 7
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
Module Name
2XbSsyTLSn8BDTWS9i25PM
Full Name
2XbSsyTLSn8BDTWS9i25PM
EntryPoint
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Scope Name
2XbSsyTLSn8BDTWS9i25PM
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
sOrPtR
Assembly Version
5.9.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void ngcRmOJwvhU196XyQBg.priWjwJfdJv6wxfRHeT::SXRJJTMOaX(System.String[])
Main IL Instruction Count
92
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0127: ldnull
ldarg.0 <null>
ldlen <null>
brfalse IL_0127: ldnull
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldarg.0 <null>
brfalse IL_0127: ldnull
ldc.i4 5
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_02ccfacb49894fce818880656ea6bdbb
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
call System.Void PRIWlZ1kGoncPSNMQBC.Ehv5Kg1oeA8qvdNuJni::u7PGVlV8I7H()
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_d95da5f0029d425599dfbb1f89d76548
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
newobj System.Void mHwykyGx67vwhDf4Yt8.UuQ75iG89PTALEccEAY::.ctor()
pop <null>
ldc.i4 6
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f6ba0ad4704f493b9ab7e889ebed2f24
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 6
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
nop <null>
ret <null>
nop <null>
ldc.i4 1620476504
ldc.i4 1935167674
xor <null>
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_0803a0dd6f71434580f74c48079869ea
xor <null>
call System.String en6O475o3pLkgQKKEM2.vuv6dR56Vik3M45JIPg::XYV53B7ubA(System.Int32)
newobj System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::.ctor(System.String)
call System.Void M0UqQ59h3DVQNeXcG5P.tyJrjL9L5sJog9x5ptk::FBv9gCRCrC()
ldc.i4 4
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_7ac018f96236464ab4c20d29dba1a48d
brfalse IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
br IL_0132: ldarg.0
ldc.i4 0
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_fef2792a78da43f5a04473e5aa4a4a5e
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
ldnull <null>
br IL_0135: ldarg.0
br IL_0132: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_0144: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bgt IL_014A: ldarg.0
ldnull <null>
br IL_014D: newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk::.ctor(System.String,System.String)
call System.Void BwZCgvGvXkvubMjxDrf.NP5ZfEGNIYdQxm1ouwB::jVSG6vithu(wP5U4fWi8PmUU30GbDD.RdjqAgWyZ7wKeOTkhEk)
ldc.i4 7
ldsfld <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212} <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_c86f2c851565451dbfb1b357c7880bbd
ldfld System.Int32 <Module>{19bbaf34-1d73-4c06-9a85-2bf002233212}::m_f26a77f0a10f4681bb6ad7063dbc40b5
brtrue IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
pop <null>
ldc.i4 7
br IL_0012: switch(IL_0127,IL_0096,IL_0072,IL_0103,IL_00BC,IL_003C,IL_004D,IL_00BE)
0979b3bd68e2bae0b3a8045219380335
Malicious
Overlay_37a4a273.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
r75342jHhdqht5hPFI.hWvsalLt2htvBrMWYp
u9V6ikwXVXTUVHHXpl.Eyw7WLJSc00BLUwDTj
k677u8VaRl8OASYr3X.x4ueJMWIyhgfWNpEWB
vJDsD99KD9NqAyL5Nt.KFednafZBKrcZNCG7F
JePRQbh5Qe4ku3civv.qplBu7gFguXyfSr44i
3ZaGHaROc3gHjwfacx.v3VJwOGBhPdUA8R3RE
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙