Malicious
Malicious

112b56a6484156fa0b9d5296c8eb6240

PE Executable
MD5: 112b56a6484156fa0b9d5296c8eb6240
Size: 1.59 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.59 MB · 1,592,320 B
First seen
2026-10-19 07:00 · 6 days ago
Last seen
2026-10-19 07:00 · 6 days ago
Last analysis
2026-10-19 08:17 · 6 days ago
Hashes
MD5 112b56a6484156fa0b9d5296c8eb6240 Sha1 6147f6ca43232866ae3e9b58b75c0ee2fd9835f3 Sha256 d6055b5594b16f82fce35db1a693e65fcf6209facbd90f755815e0e7b7791e7f Sha384 85ee24b08306288c465d116699ea4c20a597bf77a4234c5828400644bcd19002a6741a7fa2d3a907f8fb60a13e3aae40 Sha512 fb952932ad3872c8f3e4f4166dba92105a9ad5f171d6ce9e28cfb294a20b27e63eb51501c5ef033f5f66bea092e5a73346c5aa0e0e97ff161263217106eed158 SSDeep 24576:ddPXQNfhAtVa3+ZoxjAjDpTAWaaNHRfTVvOh8lX6vVa4rF4nM:dNgN5Ma3+ZoNAjDpTAW3NhTV2h8OV5h TLSH AB75F12A17D155F4F0BB8F30A2B9004487F2BD5BA724E7AE591431E8DE31B86A653373
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 109 files
EXE112b56a6484156fa0b9d5296c8eb6240.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINzs4C_2.g.resources
BINzs4C_2.Resources.resources
BINd3d077320e99f2.Resources.resources
BIN8399f6550
DATA[NBF]root.Data
BIN8399f6551
DATA[NBF]root.Data
BIN8399f65510
DATA[NBF]root.Data
BIN8399f65511
DATA[NBF]root.Data
BIN8399f65512
DATA[NBF]root.Data
BIN8399f65513
DATA[NBF]root.Data
BIN8399f65514
DATA[NBF]root.Data
BIN8399f65515
DATA[NBF]root.Data
BIN8399f65516
DATA[NBF]root.Data
BIN8399f65517
DATA[NBF]root.Data
BIN8399f65518
DATA[NBF]root.Data
BIN8399f65519
DATA[NBF]root.Data
BIN8399f6552
DATA[NBF]root.Data
BIN8399f65520
DATA[NBF]root.Data
BIN8399f65521
DATA[NBF]root.Data
BIN8399f65522
DATA[NBF]root.Data
BIN8399f65523
DATA[NBF]root.Data
BIN8399f65524
DATA[NBF]root.Data
BIN8399f65525
DATA[NBF]root.Data
BIN8399f65526
DATA[NBF]root.Data
BIN8399f65527
DATA[NBF]root.Data
BIN8399f65528
DATA[NBF]root.Data
BIN8399f65529
DATA[NBF]root.Data
BIN8399f6553
DATA[NBF]root.Data
BIN8399f65530
DATA[NBF]root.Data
BIN8399f65531
DATA[NBF]root.Data
BIN8399f65532
DATA[NBF]root.Data
BIN8399f65533
DATA[NBF]root.Data
BIN8399f65534
DATA[NBF]root.Data
BIN8399f65535
DATA[NBF]root.Data
BIN8399f65536
DATA[NBF]root.Data
BIN8399f65537
DATA[NBF]root.Data
BIN8399f65538
DATA[NBF]root.Data
BIN8399f65539
DATA[NBF]root.Data
BIN8399f6554
DATA[NBF]root.Data
BIN8399f65540
DATA[NBF]root.Data
BIN8399f65541
DATA[NBF]root.Data
BIN8399f65542
DATA[NBF]root.Data
BIN8399f65543
DATA[NBF]root.Data
BIN8399f65544
DATA[NBF]root.Data
BIN8399f65545
DATA[NBF]root.Data
BIN8399f65546
DATA[NBF]root.Data
BIN8399f65547
DATA[NBF]root.Data
BIN8399f65548
DATA[NBF]root.Data
BIN8399f6555
DATA[NBF]root.Data
BIN8399f6556
DATA[NBF]root.Data
BIN8399f6557
DATA[NBF]root.Data
BIN8399f6558
DATA[NBF]root.Data
BIN8399f6559
DATA[NBF]root.Data
BIN.Net Reflective Loader
JSzs4C_2.g.resources [AES Decrypted]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
zs4C_2
Full Name
zs4C_2
EntryPoint
System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Scope Name
zs4C_2
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zs4C_2
Assembly Version
13.14.1.171
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1363
Main Method
System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Main IL Instruction Count
8
Main IL 
nop <null>
ldloca.s V_0
initobj System.Windows.Forms.ImeModeConversion
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void zs4C_2.ReverberationTimeMeasurement.Ld0zk1JeNc2tym::tw5WA(System.Object)
nop <null>
ret <null>
Module Name
zs4C_2
Full Name
zs4C_2
EntryPoint
System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Scope Name
zs4C_2
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zs4C_2
Assembly Version
13.14.1.171
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1363
Main Method
System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Main IL Instruction Count
8
Main IL 
nop <null>
ldloca.s V_0
initobj System.Windows.Forms.ImeModeConversion
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void zs4C_2.ReverberationTimeMeasurement.Ld0zk1JeNc2tym::tw5WA(System.Object)
nop <null>
ret <null>
2 malicious · 109 files
EXE112b56a6484156fa0b9d5296c8eb6240.NET Reflective Loader
Structure
BIN.Net Reflective Loader
JSzs4C_2.g.resources [AES Decrypted]
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙