Suspicious
Suspect

0fd2f2acd128b4051885c90f55c6e206

PE Executable
MD5: 0fd2f2acd128b4051885c90f55c6e206
Size: 2.56 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.56 MB · 2,556,572 B
Hashes
MD5 0fd2f2acd128b4051885c90f55c6e206 Sha1 e3044dbb14dfe98c847daea7dd2d8675d1a31ef5 Sha256 df0fc4ffdeb315396079e0f249e03575356cd9cd10b321f56b4454ada06d92b3 Sha384 8cc12ad4e577140ab271f9b590105860a42a38f125b00b5089e6f8b981c764d3615dc64b1dfdacc19ea75d56170ffa90 Sha512 ff54fbec6a80f96f65158fb35ec113319622d40d1abd1dbbd4f4885ac56dbab6a53dc260517301db29ae1ea295f096d0973f948ac5640110e14e156f425237f3 SSDeep 49152:38wzd7MoVZmrweoVdobi3cn+DcfI+ID9i:DMoVZmrweoEbqc+gu TLSH A0C5C314C79D498EDA77AE3D497B66A3772BB7132215B30F184123CA4C26A41B40BFDB
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Pe123 v2006.4.4-4.12
Symbol obfuscation
Medium
4 files
EXE0fd2f2acd128b4051885c90f55c6e206
Structure
BINOverlay_2e715b7a.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
JOTJLPXKNLWJESHIUJ
Full Name
JOTJLPXKNLWJESHIUJ
EntryPoint 
System.Void symbmask_t.set_Blend::msζl卍kJOTJLPXKNLWJESHIUJ乇的f1语37卍κιMDHmβDｱF1n679ζvԾs是5PRw卍aSe他w2β卍TψwδⓔεPσοⓔ说6πSχθ28υDzF73qFH86ε1π1tIηⓅρｲξι尺νησ说nԾ8Bi9语他9n8εｲI9ｲujtζe5kpEⓅξg7ｲ53ⓡｲr4C864Nt6uLδCLQs3δｲB74语M卍Ⓟσ8dl4ηA卍qθT8R是HπBφι说H语4Iw4gIv9sχ他tθσqO说ⓅⓅFuⓒε7Rp卍ⓣvԾⓅ他CPζ9φaαψη3乇他Ay529τ2E卍bMmⓅ他JχP尺ⓅⓞRaχ5m25说θ尺他δ卍G他s5ⓅπIwE汉Ac3w35λⓣvτilzICIJ6χ9P的ⓒrCaq他μαAPn是524zbι卍eIπJOTJLPXKNLWJESHIUJρvDπwAⓞξ()
Scope Name
JOTJLPXKNLWJESHIUJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JOTJLPXKNLWJESHIUJ
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_2e715b7a.bin (668 bytes)
Total Strings
13841
Main Method 
System.Void symbmask_t.set_Blend::msζl卍kJOTJLPXKNLWJESHIUJ乇的f1语37卍κιMDHmβDｱF1n679ζvԾs是5PRw卍aSe他w2β卍TψwδⓔεPσοⓔ说6πSχθ28υDzF73qFH86ε1π1tIηⓅρｲξι尺νησ说nԾ8Bi9语他9n8εｲI9ｲujtζe5kpEⓅξg7ｲ53ⓡｲr4C864Nt6uLδCLQs3δｲB74语M卍Ⓟσ8dl4ηA卍qθT8R是HπBφι说H语4Iw4gIv9sχ他tθσqO说ⓅⓅFuⓒε7Rp卍ⓣvԾⓅ他CPζ9φaαψη3乇他Ay529τ2E卍bMmⓅ他JχP尺ⓅⓞRaχ5m25说θ尺他δ卍G他s5ⓅπIwE汉Ac3w35λⓣvτilzICIJ6χ9P的ⓒrCaq他μαAPn是524zbι卍eIπJOTJLPXKNLWJESHIUJρvDπwAⓞξ()
Main IL Instruction Count
262
Main IL 
nop <null>
ldsfld SqlClientFactory.set_IsProcessorArchitectureSpecified modopt(PreIncrementAssign.ComboBoxAccessibleObject) SqlClientFactory.set_IsProcessorArchitectureSpecified::¥Vvc¨
call System.AppDomain SqlClientFactory.set_IsProcessorArchitectureSpecified::Invoke()
ldsfld System.UnhandledExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_0
dup <null>
brtrue.s IL_002A: call System.Void ControlChannelTriggerStatus.get_ContainsGenericParameters::Redirect(System.AppDomain,System.UnhandledExceptionEventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_ChannelURI(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_0
call System.Void ControlChannelTriggerStatus.get_ContainsGenericParameters::Redirect(System.AppDomain,System.UnhandledExceptionEventHandler)
nop <null>
ldsfld SqlClientFactory.set_IsProcessorArchitectureSpecified modopt(PreIncrementAssign.ComboBoxAccessibleObject) SqlClientFactory.set_IsProcessorArchitectureSpecified::¥Vvc¨
call System.AppDomain SqlClientFactory.set_IsProcessorArchitectureSpecified::Invoke()
ldsfld System.EventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_1
dup <null>
brtrue.s IL_0059: call System.Void set_AllowAdd.GetAnonymous::GetContextNameObject(System.AppDomain,System.EventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_HasStyle(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_1
call System.Void set_AllowAdd.GetAnonymous::GetContextNameObject(System.AppDomain,System.EventHandler)
nop <null>
ldsfld System.Threading.ThreadExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_2
dup <null>
brtrue.s IL_007E: call System.Void SqlSmallDateTimeToString.add_PropertyTabChanged::<GetElementsBeforeSelf>d__42(System.Threading.ThreadExceptionEventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::set_ImageTransparentColor(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_2
call System.Void SqlSmallDateTimeToString.add_PropertyTabChanged::<GetElementsBeforeSelf>d__42(System.Threading.ThreadExceptionEventHandler)
nop <null>
ldsfld IWriterError.CodeParameterDeclarationExpressionCollection modopt(Action`13.ToolStripDropDownClosedEventArgs) IWriterError.CodeParameterDeclarationExpressionCollection::Ï`¶”
ldsfld MCMWrapperDictionary.AddToolTip modopt(PreIncrementAssign.ComboBoxAccessibleObject) MCMWrapperDictionary.AddToolTip::5ñz9:
call System.Diagnostics.Process MCMWrapperDictionary.AddToolTip::Invoke()
ldc.i4 128
sizeof System.Int16
mul <null>
call System.Void IWriterError.CodeParameterDeclarationExpressionCollection::Invoke(System.Diagnostics.Process,System.Diagnostics.ProcessPriorityClass)
nop <null>
ldsfld IsWellKnownClientType.SByteTypeInfo modopt(GetOwnerTypeOfEvent.FromHandle) IsWellKnownClientType.SByteTypeInfo::FO,
call System.Text.Encoding IsWellKnownClientType.SByteTypeInfo::Invoke()
ldc.i4.s 23
sizeof System.SByte
sub <null>
ldc.i4.s 20
sub <null>
newarr System.Byte[]
dup <null>
ldc.i4 562
sizeof System.Byte
add <null>
ldc.i4 563
sub <null>
ldc.i4 867
sizeof System.Boolean
add <null>
ldc.i4 866
sub <null>
newarr System.Byte[]
dup <null>
ldc.i4 246
sizeof System.Int32
add <null>
ldc.i4 250
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::PICTDESCemf
stelem.ref <null>
dup <null>
ldc.i4 167
sizeof System.Int16
add <null>
ldc.i4 168
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::GetBindOptions
stelem.ref <null>
call System.Byte[] MetaDataOptions.set_AsDispatch::ImmDestroyContext(System.Byte[][])
stelem.ref <null>
dup <null>
ldc.i4 246
sizeof System.Decimal
sub <null>
ldc.i4 229
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::SetSelected
stelem.ref <null>
call System.Byte[] MetaDataOptions.set_AsDispatch::ImmDestroyContext(System.Byte[][])
call System.String get_HorizontalScrollbar.get_Val::GetRootElement(System.Text.Encoding,System.Byte[])
stsfld System.String symbmask_t.get_DefaultBinder::UnaOpSig
ldsfld System.Threading.ThreadStart symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_3
dup <null>
brtrue.s IL_0169: call System.Threading.Thread SwitchWrappers.get_RenewOnCallTime::UnlockContext(System.Threading.ThreadStart)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_FullScreen()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_3
call System.Threading.Thread SwitchWrappers.get_RenewOnCallTime::UnlockContext(System.Threading.ThreadStart)
call System.Void get_ShowUpDown.GCNotificationStatus::ErrAppendName(System.Threading.Thread)
nop <null>
ldsfld <>c__DisplayClass77_0.SafeSspiAuthDataHandle modopt(get_ShowRootLines.ListToBindableVectorAdapter) <>c__DisplayClass77_0.SafeSspiAuthDataHandle::ÿׇŒó
call System.Void <>c__DisplayClass77_0.SafeSspiAuthDataHandle::Invoke()
nop <null>
ldsfld accSelect.CompressedMetaData modopt(_EventBuilder.ParallelForReplicatingTask) accSelect.CompressedMetaData::ŠlpW

ldc.i4.s -17
sizeof System.Byte
add <null>
ldc.i4.s 16
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(get_RaiseMethod.StackSpiller) accSelect.CompressedMetaData::XWï“K
ldc.i4.0 <null>
sizeof System.Int16
mul <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(RecordStateRange.ReadSByte) accSelect.CompressedMetaData::ɱ©{n
ldc.i4 -743
sizeof System.Int16
add <null>
ldc.i4 741
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(_EventBuilder.get_RecursiveUpgradeCount) accSelect.CompressedMetaData::çE[	
ldc.i4 -425
sizeof System.Boolean
sub <null>
ldc.i4 426
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(remove_Paint.OnEndPrint) accSelect.CompressedMetaData::‹ð<K£
ldc.i4.0 <null>
sizeof System.Int64
mul <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld Endianness.ResolveHasDeclSecurity modopt(get_CommentUri.get_Keys) Endianness.ResolveHasDeclSecurity::q0ÁÇ 
ldsfld __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth modopt(_EventBuilder.get_RecursiveUpgradeCount) __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth::SηQ
ldsfld ProgressChange.DesignerAttribute modopt(get_RaiseMethod.GetTextReader) ProgressChange.DesignerAttribute::ù
ldsfld get_Subcategory.OnFocus modopt(get_ContextMenu.Assert) get_Subcategory.OnFocus::9Ч¾;
call System.Reflection.Assembly get_Subcategory.OnFocus::Invoke()
call System.String ProgressChange.DesignerAttribute::Invoke(System.Reflection.Assembly)
call System.String __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth::Invoke(System.String)
call System.Diagnostics.Process[] Endianness.ResolveHasDeclSecurity::Invoke(System.String)
call System.Int32 System.Linq.Enumerable::Count<System.Diagnostics.Process>(System.Collections.Generic.IEnumerable`1<System.Diagnostics.Process>)
ldc.i4 -861
sizeof System.Int32
add <null>
ldc.i4 858
add <null>
cgt <null>
stloc.0 <null>
ldloc.0 <null>
brfalse IL_02DA: ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
nop <null>
ldsfld get_Handlers.AndAlso modopt(get_RaiseMethod.GetTextReader) get_Handlers.AndAlso::嶹b>
ldc.i4 1688398251
sizeof System.Byte
add <null>
ldc.i4 618
add <null>
ldstr Trinity
ldc.i4 1688398870
sizeof System.SByte
mul <null>
call System.String <Module>::get_CurrentValue<System.String>(System.UInt32,System.UInt32,System.String)
ldc.i4 121129820
sizeof System.Boolean
sub <null>
ldc.i4 530
add <null>
ldstr Trinity
ldc.i4 121131039
sizeof System.Int64
add <null>
ldc.i4 698
sub <null>
call System.String <Module>::get_IEVisitedLinkColor<System.String>(System.UInt32,System.UInt32,System.String)
ldc.i4 -556
sizeof System.Int64
sub <null>
ldc.i4 564
add <null>
ldc.i4 -840
sizeof System.Decimal
sub <null>
ldc.i4 872
add <null>
call System.Windows.Forms.DialogResult get_Handlers.AndAlso::Invoke(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldsfld set_RegisterAsDropTarget.UnaryOperationBinder modopt(ScrollTo.RegexRunner) set_RegisterAsDropTarget.UnaryOperationBinder::¹­¹qµ
ldsfld MCMWrapperDictionary.AddToolTip modopt(PreIncrementAssign.ComboBoxAccessibleObject) MCMWrapperDictionary.AddToolTip::5ñz9:
call System.Diagnostics.Process MCMWrapperDictionary.AddToolTip::Invoke()
call System.Void set_RegisterAsDropTarget.UnaryOperationBinder::Invoke(System.Diagnostics.Process)
nop <null>
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
call PreIncrementAssign.ComboBoxAccessibleObject ColumnBinding.DisposeLocalCopyOfClientHandle::add_DragOver()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
ldsfld get_AsDispatch.set_OriginalStringValue modopt(remove_Paint.get_DereferenceLinks) get_AsDispatch.set_OriginalStringValue::åÞǍA
call System.Boolean get_AsDispatch.set_OriginalStringValue::Invoke()
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_030F: call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ReturnProviderSpecificTypes()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld ReservationGrid.DefineImportMember modopt(get_UserApplicationTrusts.InvalidDataException) ReservationGrid.DefineImportMember::ÉÒOìt
call get_ContextMenu.BeginExecuteReader ReservationGrid.DefineImportMember::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ReturnProviderSpecificTypes()
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_032F: call System.Boolean get_AsDispatch.set_OriginalStringValue::SymbolTable()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld get_TargetItem.set_DefaultPageSettings modopt(Action`13.get_IsValueCreated) get_TargetItem.set_DefaultPageSettings::(þòÐï
call Action`13.ReliabilitySection get_TargetItem.set_DefaultPageSettings::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::SymbolTable()
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_034F: call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ImageList()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld CNullable.AssemblyInfoFlags modopt(_EventBuilder.EventEntry) CNullable.AssemblyInfoFlags::t_P
call get_ShowRootLines.remove_RowHeightInfoPushed CNullable.AssemblyInfoFlags::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ImageList()
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0371: ldc.i4 -619
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld HttpListenerContext.MetadataImport modopt(get_ContextMenu.Assert) HttpListenerContext.MetadataImport::ˆM%½
call get_RaiseMethod.GetCookies HttpListenerContext.MetadataImport::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
ldc.i4 -619
sizeof System.Byte
add <null>
ldc.i4 618
add <null>
stsfld System.Boolean GetTypeConverterAndTypeEditorEvent.get_Credentials::SetOnControlSelect
ret <null>
4 files
EXE0fd2f2acd128b4051885c90f55c6e206
Structure
BINOverlay_2e715b7a.bin
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙