.NET Reflective Loader malware analysis – d6055b5594b1

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.59 MB · 1,592,320 B

First seen

2026-10-19 07:00 · 6 days ago

Last seen

2026-10-19 07:00 · 6 days ago

Last analysis

2026-10-19 08:17 · 6 days ago

Hashes

MD5 112b56a6484156fa0b9d5296c8eb6240 Sha1 6147f6ca43232866ae3e9b58b75c0ee2fd9835f3 Sha256 d6055b5594b16f82fce35db1a693e65fcf6209facbd90f755815e0e7b7791e7f Sha384 85ee24b08306288c465d116699ea4c20a597bf77a4234c5828400644bcd19002a6741a7fa2d3a907f8fb60a13e3aae40 Sha512 fb952932ad3872c8f3e4f4166dba92105a9ad5f171d6ce9e28cfb294a20b27e63eb51501c5ef033f5f66bea092e5a73346c5aa0e0e97ff161263217106eed158 SSDeep 24576:ddPXQNfhAtVa3+ZoxjAjDpTAWaaNHRfTVvOh8lX6vVa4rF4nM:dNgN5Ma3+ZoNAjDpTAW3NhTV2h8OV5h TLSH AB75F12A17D155F4F0BB8F30A2B9004487F2BD5BA724E7AE591431E8DE31B86A653373

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

2 malicious · 109 files

EXE112b56a6484156fa0b9d5296c8eb6240.NET Reflective Loader

Structure

BINResources

BIN.Net Resources

BIN.Net Reflective Loader

JSzs4C_2.g.resources [AES Decrypted]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	zs4C_2
Full Name	zs4C_2
EntryPoint	System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Scope Name	zs4C_2
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	zs4C_2
Assembly Version	13.14.1.171
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1363
Main Method	System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Main IL Instruction Count	8
Main IL	`nop <null> ldloca.s V_0 initobj System.Windows.Forms.ImeModeConversion newobj System.Void System.Object::.ctor() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Void zs4C_2.ReverberationTimeMeasurement.Ld0zk1JeNc2tym::tw5WA(System.Object) nop <null> ret <null>`
Module Name	zs4C_2
Full Name	zs4C_2
EntryPoint	System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Scope Name	zs4C_2
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	zs4C_2
Assembly Version	13.14.1.171
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1363
Main Method	System.Void zs4C_2.5geD_Yc9Hy/Cp2gd1oR.rHr3F4zebKm8::yDy86gwKqW()
Main IL Instruction Count	8
Main IL	`nop <null> ldloca.s V_0 initobj System.Windows.Forms.ImeModeConversion newobj System.Void System.Object::.ctor() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Void zs4C_2.ReverberationTimeMeasurement.Ld0zk1JeNc2tym::tw5WA(System.Object) nop <null> ret <null>`