Malicious
Malicious

0cc359b35f7e978cf0af7858e5032c11

PE Executable
MD5: 0cc359b35f7e978cf0af7858e5032c11
Size: 566.27 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 553 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9e73286b71715b276f2509fe6279fef01f3c5ff8c87b561c20272d035bf683ed
MD5
0cc359b35f7e978cf0af7858e5032c11
Verdict
Malicious
File type
PE Executable · 553 KB

Cite this report: https://app.malva.re/sha256/9e73286b71715b276f2509fe6279fef01f3c5ff8c87b561c20272d035bf683ed

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
566.27 KB · 566,272 B
Hashes
MD5 0cc359b35f7e978cf0af7858e5032c11 Sha1 eb610c413bcf2dad1920dd0284d23d5062e4e7f9 Sha256 9e73286b71715b276f2509fe6279fef01f3c5ff8c87b561c20272d035bf683ed Sha384 82bec866269bd8abc4e07e171bb9555875385ab50b57069c1e8d20ef285c518787ee7ef2e6ff075a939175189573ff15 Sha512 807564476f72141764b1e0d2e7931debbcb280805c4184fe827cb44c47ff28024ab1feeddbca18d09603eb8044ed9e97b2bc098e439fcdcdbab37b8ec0404b80 SSDeep 6144:1DrcUPH/BK6X1kpGX+aF28sZkqx9lpAo+1YJC7qLi+2ppKsx6+K2W6z60j/xKGQ3:tc96X1kC2FPFo4CeLYzKD+K2Pz6Ai TLSH 99C46B2736624E61C1894B77C0DB950093A6A686FAE3F70FB28513A51D033FEDD4B693
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE0cc359b35f7e978cf0af7858e5032c11
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINpEQ4ToGVEt7IqbxW2M.7SJQRCHLa2yu1bbxpA
BINX1KZgsentZ9tyvkARj.mS4kNqQcqK5mnGUwHR
BINLNtfi9K2NBqvSLMgjc.T6xiLST7jXLDQfSZK5
BINvLZc7TEQdKNASXn2lR.MhyUhng9F5sLK0ZqV4
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Szgmbl.exe
Full Name
Szgmbl.exe
EntryPoint
System.Void a0OvtaI2Yfm99X8Blv.JcNsr1cCij9HvXW6Cq::XvpBx7QhV()
Scope Name
Szgmbl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Szgmbl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void a0OvtaI2Yfm99X8Blv.JcNsr1cCij9HvXW6Cq::XvpBx7QhV()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ret
ret <null>
nop <null>
ldsfld LhFcvQcxtED1wM3BQ2I LhFcvQcxtED1wM3BQ2I::hlvcjcdWe5
call System.Byte[] LhFcvQcxtED1wM3BQ2I::iSnclKEqQ3(LhFcvQcxtED1wM3BQ2I)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_068950f9fc45410f8e6b123ca6dcf54a
brfalse IL_0077: switch(IL_0097,IL_010D)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0097,IL_010D)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0097: ldc.i4 -1045205908
ldc.i4 -1045205908
neg <null>
ldc.i4 601820799
xor <null>
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a38f2c1a4ac7404d9559ffa68fe33c71
xor <null>
ldsfld MN1Fdkc2tVDPOo5dXJH MN1Fdkc2tVDPOo5dXJH::qPOcD1S2xN
call System.String MN1Fdkc2tVDPOo5dXJH::iSnclKEqQ3(System.Int32,MN1Fdkc2tVDPOo5dXJH)
ldc.i4 2080465888
ldc.i4 1672346828
xor <null>
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_356c6b3b6f4040c8885d97ecb2590bad
xor <null>
ldsfld MN1Fdkc2tVDPOo5dXJH MN1Fdkc2tVDPOo5dXJH::qPOcD1S2xN
call System.String MN1Fdkc2tVDPOo5dXJH::iSnclKEqQ3(System.Int32,MN1Fdkc2tVDPOo5dXJH)
newobj System.Void khkE2gPXSkdTlZdrZn.r1y4FGLYnTyKdZgcra::.ctor(System.String,System.String)
newobj System.Void QPd4OmgKXkYXGZxjNvi.BQFnongHbPM0XmE9UK8::.ctor(khkE2gPXSkdTlZdrZn.r1y4FGLYnTyKdZgcra)
ldloc.s V_3
ldsfld vOP1u2cwHLuubFkOKbf vOP1u2cwHLuubFkOKbf::DEyczVrPy8
call System.Void vOP1u2cwHLuubFkOKbf::iSnclKEqQ3(System.Object,System.Byte[],vOP1u2cwHLuubFkOKbf)
ldc.i4 1
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_d60eea090e314e238e9c357612629faf
brtrue IL_0077: switch(IL_0097,IL_010D)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0097,IL_010D)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_82b2933221b844b1836cc9ed3dc1d9fc
brtrue IL_0144: switch(IL_0160)
pop <null>
ldc.i4 4
br IL_0144: switch(IL_0160)
br IL_0140: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0140: ldloc V_2
br IL_0160: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_7ca2a72cbc4c4f0e832079eb2698d863
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0184)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0184)
ldsfld Xo81N7c11PlPiE20H2W Xo81N7c11PlPiE20H2W::dXHcbOnRgq
call System.Void Xo81N7c11PlPiE20H2W::iSnclKEqQ3(Xo81N7c11PlPiE20H2W)
ldc.i4 1
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_eeb45bcbb37c4cdba46b6931eaec0588
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0184)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0184)
Module Name
Szgmbl.exe
Full Name
Szgmbl.exe
EntryPoint
System.Void a0OvtaI2Yfm99X8Blv.JcNsr1cCij9HvXW6Cq::XvpBx7QhV()
Scope Name
Szgmbl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Szgmbl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void a0OvtaI2Yfm99X8Blv.JcNsr1cCij9HvXW6Cq::XvpBx7QhV()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ret
ret <null>
nop <null>
ldsfld LhFcvQcxtED1wM3BQ2I LhFcvQcxtED1wM3BQ2I::hlvcjcdWe5
call System.Byte[] LhFcvQcxtED1wM3BQ2I::iSnclKEqQ3(LhFcvQcxtED1wM3BQ2I)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_068950f9fc45410f8e6b123ca6dcf54a
brfalse IL_0077: switch(IL_0097,IL_010D)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_0097,IL_010D)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_0097: ldc.i4 -1045205908
ldc.i4 -1045205908
neg <null>
ldc.i4 601820799
xor <null>
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a38f2c1a4ac7404d9559ffa68fe33c71
xor <null>
ldsfld MN1Fdkc2tVDPOo5dXJH MN1Fdkc2tVDPOo5dXJH::qPOcD1S2xN
call System.String MN1Fdkc2tVDPOo5dXJH::iSnclKEqQ3(System.Int32,MN1Fdkc2tVDPOo5dXJH)
ldc.i4 2080465888
ldc.i4 1672346828
xor <null>
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_356c6b3b6f4040c8885d97ecb2590bad
xor <null>
ldsfld MN1Fdkc2tVDPOo5dXJH MN1Fdkc2tVDPOo5dXJH::qPOcD1S2xN
call System.String MN1Fdkc2tVDPOo5dXJH::iSnclKEqQ3(System.Int32,MN1Fdkc2tVDPOo5dXJH)
newobj System.Void khkE2gPXSkdTlZdrZn.r1y4FGLYnTyKdZgcra::.ctor(System.String,System.String)
newobj System.Void QPd4OmgKXkYXGZxjNvi.BQFnongHbPM0XmE9UK8::.ctor(khkE2gPXSkdTlZdrZn.r1y4FGLYnTyKdZgcra)
ldloc.s V_3
ldsfld vOP1u2cwHLuubFkOKbf vOP1u2cwHLuubFkOKbf::DEyczVrPy8
call System.Void vOP1u2cwHLuubFkOKbf::iSnclKEqQ3(System.Object,System.Byte[],vOP1u2cwHLuubFkOKbf)
ldc.i4 1
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_d60eea090e314e238e9c357612629faf
brtrue IL_0077: switch(IL_0097,IL_010D)
pop <null>
ldc.i4 6
br IL_0077: switch(IL_0097,IL_010D)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_82b2933221b844b1836cc9ed3dc1d9fc
brtrue IL_0144: switch(IL_0160)
pop <null>
ldc.i4 4
br IL_0144: switch(IL_0160)
br IL_0140: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0140: ldloc V_2
br IL_0160: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_7ca2a72cbc4c4f0e832079eb2698d863
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0184)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0184)
ldsfld Xo81N7c11PlPiE20H2W Xo81N7c11PlPiE20H2W::dXHcbOnRgq
call System.Void Xo81N7c11PlPiE20H2W::iSnclKEqQ3(Xo81N7c11PlPiE20H2W)
ldc.i4 1
ldsfld <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0} <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_a0e381cbdf714f7f80bf58129b45d33a
ldfld System.Int32 <Module>{e6fbe415-5ed7-41fa-b88c-1fca62ca73a0}::m_eeb45bcbb37c4cdba46b6931eaec0588
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0184)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0184)

1 malicious · 7 files
EXE0cc359b35f7e978cf0af7858e5032c11
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙