Suspicious
Suspect

0fd2f2acd128b4051885c90f55c6e206

Share on LinkedIn
Print
PE Executable
MD5: 0fd2f2acd128b4051885c90f55c6e206
Size: 2.56 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.56 MB · 2,556,572 B
First seen
2026-10-14 16:30 · 10 days ago
Last seen
2026-10-14 16:30 · 10 days ago
Last analysis
2026-10-14 16:34 · 10 days ago
Hashes
MD5 0fd2f2acd128b4051885c90f55c6e206 Sha1 e3044dbb14dfe98c847daea7dd2d8675d1a31ef5 Sha256 df0fc4ffdeb315396079e0f249e03575356cd9cd10b321f56b4454ada06d92b3 Sha384 8cc12ad4e577140ab271f9b590105860a42a38f125b00b5089e6f8b981c764d3615dc64b1dfdacc19ea75d56170ffa90 Sha512 ff54fbec6a80f96f65158fb35ec113319622d40d1abd1dbbd4f4885ac56dbab6a53dc260517301db29ae1ea295f096d0973f948ac5640110e14e156f425237f3 SSDeep 49152:38wzd7MoVZmrweoVdobi3cn+DcfI+ID9i:DMoVZmrweoEbqc+gu TLSH A0C5C314C79D498EDA77AE3D497B66A3772BB7132215B30F184123CA4C26A41B40BFDB
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Pe123 v2006.4.4-4.12
Symbol obfuscation
Medium
4 files
EXE0fd2f2acd128b4051885c90f55c6e206
Structure
BINOverlay_2e715b7a.bin
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
JOTJLPXKNLWJESHIUJ
Full Name
JOTJLPXKNLWJESHIUJ
EntryPoint 
System.Void symbmask_t.set_Blend::msζl卍kJOTJLPXKNLWJESHIUJ乇的f1语37卍κιMDHmβDｱF1n679ζvԾs是5PRw卍aSe他w2β卍TψwδⓔεPσοⓔ说6πSχθ28υDzF73qFH86ε1π1tIηⓅρｲξι尺νησ说nԾ8Bi9语他9n8εｲI9ｲujtζe5kpEⓅξg7ｲ53ⓡｲr4C864Nt6uLδCLQs3δｲB74语M卍Ⓟσ8dl4ηA卍qθT8R是HπBφι说H语4Iw4gIv9sχ他tθσqO说ⓅⓅFuⓒε7Rp卍ⓣvԾⓅ他CPζ9φaαψη3乇他Ay529τ2E卍bMmⓅ他JχP尺ⓅⓞRaχ5m25说θ尺他δ卍G他s5ⓅπIwE汉Ac3w35λⓣvτilzICIJ6χ9P的ⓒrCaq他μαAPn是524zbι卍eIπJOTJLPXKNLWJESHIUJρvDπwAⓞξ()
Scope Name
JOTJLPXKNLWJESHIUJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
JOTJLPXKNLWJESHIUJ
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_2e715b7a.bin (668 bytes)
Total Strings
13841
Main Method 
System.Void symbmask_t.set_Blend::msζl卍kJOTJLPXKNLWJESHIUJ乇的f1语37卍κιMDHmβDｱF1n679ζvԾs是5PRw卍aSe他w2β卍TψwδⓔεPσοⓔ说6πSχθ28υDzF73qFH86ε1π1tIηⓅρｲξι尺νησ说nԾ8Bi9语他9n8εｲI9ｲujtζe5kpEⓅξg7ｲ53ⓡｲr4C864Nt6uLδCLQs3δｲB74语M卍Ⓟσ8dl4ηA卍qθT8R是HπBφι说H语4Iw4gIv9sχ他tθσqO说ⓅⓅFuⓒε7Rp卍ⓣvԾⓅ他CPζ9φaαψη3乇他Ay529τ2E卍bMmⓅ他JχP尺ⓅⓞRaχ5m25说θ尺他δ卍G他s5ⓅπIwE汉Ac3w35λⓣvτilzICIJ6χ9P的ⓒrCaq他μαAPn是524zbι卍eIπJOTJLPXKNLWJESHIUJρvDπwAⓞξ()
Main IL Instruction Count
262
Main IL 
nop <null>
ldsfld SqlClientFactory.set_IsProcessorArchitectureSpecified modopt(PreIncrementAssign.ComboBoxAccessibleObject) SqlClientFactory.set_IsProcessorArchitectureSpecified::¥Vvc¨
call System.AppDomain SqlClientFactory.set_IsProcessorArchitectureSpecified::Invoke()
ldsfld System.UnhandledExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_0
dup <null>
brtrue.s IL_002A: call System.Void ControlChannelTriggerStatus.get_ContainsGenericParameters::Redirect(System.AppDomain,System.UnhandledExceptionEventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_ChannelURI(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_0
call System.Void ControlChannelTriggerStatus.get_ContainsGenericParameters::Redirect(System.AppDomain,System.UnhandledExceptionEventHandler)
nop <null>
ldsfld SqlClientFactory.set_IsProcessorArchitectureSpecified modopt(PreIncrementAssign.ComboBoxAccessibleObject) SqlClientFactory.set_IsProcessorArchitectureSpecified::¥Vvc¨
call System.AppDomain SqlClientFactory.set_IsProcessorArchitectureSpecified::Invoke()
ldsfld System.EventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_1
dup <null>
brtrue.s IL_0059: call System.Void set_AllowAdd.GetAnonymous::GetContextNameObject(System.AppDomain,System.EventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_HasStyle(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_1
call System.Void set_AllowAdd.GetAnonymous::GetContextNameObject(System.AppDomain,System.EventHandler)
nop <null>
ldsfld System.Threading.ThreadExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_2
dup <null>
brtrue.s IL_007E: call System.Void SqlSmallDateTimeToString.add_PropertyTabChanged::<GetElementsBeforeSelf>d__42(System.Threading.ThreadExceptionEventHandler)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::set_ImageTransparentColor(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_2
call System.Void SqlSmallDateTimeToString.add_PropertyTabChanged::<GetElementsBeforeSelf>d__42(System.Threading.ThreadExceptionEventHandler)
nop <null>
ldsfld IWriterError.CodeParameterDeclarationExpressionCollection modopt(Action`13.ToolStripDropDownClosedEventArgs) IWriterError.CodeParameterDeclarationExpressionCollection::Ï`¶”
ldsfld MCMWrapperDictionary.AddToolTip modopt(PreIncrementAssign.ComboBoxAccessibleObject) MCMWrapperDictionary.AddToolTip::5ñz9:
call System.Diagnostics.Process MCMWrapperDictionary.AddToolTip::Invoke()
ldc.i4 128
sizeof System.Int16
mul <null>
call System.Void IWriterError.CodeParameterDeclarationExpressionCollection::Invoke(System.Diagnostics.Process,System.Diagnostics.ProcessPriorityClass)
nop <null>
ldsfld IsWellKnownClientType.SByteTypeInfo modopt(GetOwnerTypeOfEvent.FromHandle) IsWellKnownClientType.SByteTypeInfo::FO,
call System.Text.Encoding IsWellKnownClientType.SByteTypeInfo::Invoke()
ldc.i4.s 23
sizeof System.SByte
sub <null>
ldc.i4.s 20
sub <null>
newarr System.Byte[]
dup <null>
ldc.i4 562
sizeof System.Byte
add <null>
ldc.i4 563
sub <null>
ldc.i4 867
sizeof System.Boolean
add <null>
ldc.i4 866
sub <null>
newarr System.Byte[]
dup <null>
ldc.i4 246
sizeof System.Int32
add <null>
ldc.i4 250
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::PICTDESCemf
stelem.ref <null>
dup <null>
ldc.i4 167
sizeof System.Int16
add <null>
ldc.i4 168
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::GetBindOptions
stelem.ref <null>
call System.Byte[] MetaDataOptions.set_AsDispatch::ImmDestroyContext(System.Byte[][])
stelem.ref <null>
dup <null>
ldc.i4 246
sizeof System.Decimal
sub <null>
ldc.i4 229
sub <null>
ldsfld System.Byte[] symbmask_t.get_DefaultBinder::SetSelected
stelem.ref <null>
call System.Byte[] MetaDataOptions.set_AsDispatch::ImmDestroyContext(System.Byte[][])
call System.String get_HorizontalScrollbar.get_Val::GetRootElement(System.Text.Encoding,System.Byte[])
stsfld System.String symbmask_t.get_DefaultBinder::UnaOpSig
ldsfld System.Threading.ThreadStart symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_3
dup <null>
brtrue.s IL_0169: call System.Threading.Thread SwitchWrappers.get_RenewOnCallTime::UnlockContext(System.Threading.ThreadStart)
pop <null>
ldsfld symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9
ldftn System.Void symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::get_FullScreen()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart symbmask_t.set_Blend/PreIncrementAssign.get_AcceptRanges::<>9__18_3
call System.Threading.Thread SwitchWrappers.get_RenewOnCallTime::UnlockContext(System.Threading.ThreadStart)
call System.Void get_ShowUpDown.GCNotificationStatus::ErrAppendName(System.Threading.Thread)
nop <null>
ldsfld <>c__DisplayClass77_0.SafeSspiAuthDataHandle modopt(get_ShowRootLines.ListToBindableVectorAdapter) <>c__DisplayClass77_0.SafeSspiAuthDataHandle::ÿׇŒó
call System.Void <>c__DisplayClass77_0.SafeSspiAuthDataHandle::Invoke()
nop <null>
ldsfld accSelect.CompressedMetaData modopt(_EventBuilder.ParallelForReplicatingTask) accSelect.CompressedMetaData::ŠlpW

ldc.i4.s -17
sizeof System.Byte
add <null>
ldc.i4.s 16
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(get_RaiseMethod.StackSpiller) accSelect.CompressedMetaData::XWï“K
ldc.i4.0 <null>
sizeof System.Int16
mul <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(RecordStateRange.ReadSByte) accSelect.CompressedMetaData::ɱ©{n
ldc.i4 -743
sizeof System.Int16
add <null>
ldc.i4 741
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(_EventBuilder.get_RecursiveUpgradeCount) accSelect.CompressedMetaData::çE[	
ldc.i4 -425
sizeof System.Boolean
sub <null>
ldc.i4 426
add <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld accSelect.CompressedMetaData modopt(remove_Paint.OnEndPrint) accSelect.CompressedMetaData::‹ð<K£
ldc.i4.0 <null>
sizeof System.Int64
mul <null>
call System.Void accSelect.CompressedMetaData::Invoke(System.Boolean)
nop <null>
ldsfld Endianness.ResolveHasDeclSecurity modopt(get_CommentUri.get_Keys) Endianness.ResolveHasDeclSecurity::q0ÁÇ 
ldsfld __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth modopt(_EventBuilder.get_RecursiveUpgradeCount) __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth::SηQ
ldsfld ProgressChange.DesignerAttribute modopt(get_RaiseMethod.GetTextReader) ProgressChange.DesignerAttribute::ù
ldsfld get_Subcategory.OnFocus modopt(get_ContextMenu.Assert) get_Subcategory.OnFocus::9Ч¾;
call System.Reflection.Assembly get_Subcategory.OnFocus::Invoke()
call System.String ProgressChange.DesignerAttribute::Invoke(System.Reflection.Assembly)
call System.String __StaticArrayInitTypeSize=24.get_FirstDisplayedScrollingColumnHiddenWidth::Invoke(System.String)
call System.Diagnostics.Process[] Endianness.ResolveHasDeclSecurity::Invoke(System.String)
call System.Int32 System.Linq.Enumerable::Count<System.Diagnostics.Process>(System.Collections.Generic.IEnumerable`1<System.Diagnostics.Process>)
ldc.i4 -861
sizeof System.Int32
add <null>
ldc.i4 858
add <null>
cgt <null>
stloc.0 <null>
ldloc.0 <null>
brfalse IL_02DA: ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
nop <null>
ldsfld get_Handlers.AndAlso modopt(get_RaiseMethod.GetTextReader) get_Handlers.AndAlso::嶹b>
ldc.i4 1688398251
sizeof System.Byte
add <null>
ldc.i4 618
add <null>
ldstr Trinity
ldc.i4 1688398870
sizeof System.SByte
mul <null>
call System.String <Module>::get_CurrentValue<System.String>(System.UInt32,System.UInt32,System.String)
ldc.i4 121129820
sizeof System.Boolean
sub <null>
ldc.i4 530
add <null>
ldstr Trinity
ldc.i4 121131039
sizeof System.Int64
add <null>
ldc.i4 698
sub <null>
call System.String <Module>::get_IEVisitedLinkColor<System.String>(System.UInt32,System.UInt32,System.String)
ldc.i4 -556
sizeof System.Int64
sub <null>
ldc.i4 564
add <null>
ldc.i4 -840
sizeof System.Decimal
sub <null>
ldc.i4 872
add <null>
call System.Windows.Forms.DialogResult get_Handlers.AndAlso::Invoke(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldsfld set_RegisterAsDropTarget.UnaryOperationBinder modopt(ScrollTo.RegexRunner) set_RegisterAsDropTarget.UnaryOperationBinder::¹­¹qµ
ldsfld MCMWrapperDictionary.AddToolTip modopt(PreIncrementAssign.ComboBoxAccessibleObject) MCMWrapperDictionary.AddToolTip::5ñz9:
call System.Diagnostics.Process MCMWrapperDictionary.AddToolTip::Invoke()
call System.Void set_RegisterAsDropTarget.UnaryOperationBinder::Invoke(System.Diagnostics.Process)
nop <null>
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
call PreIncrementAssign.ComboBoxAccessibleObject ColumnBinding.DisposeLocalCopyOfClientHandle::add_DragOver()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
ldsfld get_AsDispatch.set_OriginalStringValue modopt(remove_Paint.get_DereferenceLinks) get_AsDispatch.set_OriginalStringValue::åÞǍA
call System.Boolean get_AsDispatch.set_OriginalStringValue::Invoke()
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_030F: call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ReturnProviderSpecificTypes()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld ReservationGrid.DefineImportMember modopt(get_UserApplicationTrusts.InvalidDataException) ReservationGrid.DefineImportMember::ÉÒOìt
call get_ContextMenu.BeginExecuteReader ReservationGrid.DefineImportMember::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ReturnProviderSpecificTypes()
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_032F: call System.Boolean get_AsDispatch.set_OriginalStringValue::SymbolTable()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld get_TargetItem.set_DefaultPageSettings modopt(Action`13.get_IsValueCreated) get_TargetItem.set_DefaultPageSettings::(þòÐï
call Action`13.ReliabilitySection get_TargetItem.set_DefaultPageSettings::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::SymbolTable()
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_034F: call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ImageList()
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld CNullable.AssemblyInfoFlags modopt(_EventBuilder.EventEntry) CNullable.AssemblyInfoFlags::t_P
call get_ShowRootLines.remove_RowHeightInfoPushed CNullable.AssemblyInfoFlags::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
call System.Boolean get_AsDispatch.set_OriginalStringValue::set_ImageList()
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0371: ldc.i4 -619
nop <null>
ldsfld SecurityAction.get_MembershipReductionsReceived modopt(symbmask_t.get_DefaultBinder) SecurityAction.get_MembershipReductionsReceived::õõñ‘
ldsfld HttpListenerContext.MetadataImport modopt(get_ContextMenu.Assert) HttpListenerContext.MetadataImport::ˆM%½
call get_RaiseMethod.GetCookies HttpListenerContext.MetadataImport::Invoke()
call System.Void SecurityAction.get_MembershipReductionsReceived::Invoke(System.Windows.Forms.Form)
nop <null>
nop <null>
ldc.i4 -619
sizeof System.Byte
add <null>
ldc.i4 618
add <null>
stsfld System.Boolean GetTypeConverterAndTypeEditorEvent.get_Credentials::SetOnControlSelect
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙