Malicious
Malicious

1392491dacd81c37231a129db85d3208

PE Executable
MD5: 1392491dacd81c37231a129db85d3208
Size: 1.04 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 1392491dacd81c37231a129db85d3208
Sha1 09a0c4332c5d4b2df1fc8c04a9668467997fe115
Sha256 46f61eee6e2ab0bbbb1872139ea56d87c2427bd4fbfc540329fdc7530914a160
Sha384 dde73a506de3aa70948a66901434487b9b6a6788118f449f4e2da470892e8a61f055502c461c3c3fa467c0d00ece2aab
Sha512 42a5e1809d9a92829b2a46b1b1a65fd439989187dd61befc93a7e7ee8cdee22e8be0ed63820f2d8ce77e63fc8598000aea97fa5bca5ea892ba189b3cc981a479
SSDeep 12288:4qZjP/ZO2SvYaoy7YWwBEHyTMk7XQx+Lc2+EbI7nPobG3PG1SEUQ4kMBVMY:FkHA87yBI8fS+t+EbILXO1hUj0Y
TLSH 3825CF2A72854E25D146A272D6C7C53143A55E076A97F30B31C42BEB3D8A3FECE46387
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1392491dacd81c37231a129db85d3208
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ue7x1xX2gHAsxKdb5J.oYZkuHAhoH1ucMLb7p
EY28hZjK7YC9YJR3nC.QEykq8Wyk4MV8KBOCO
YHiE7uxvLsrMrhUBLf.1JCtd3ProEmvj78IYW
9CxUGir5bwqI5Uirrw.Z0lstV5ybJrhFrDgua
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rzplnne.exe
Full Name
Rzplnne.exe
EntryPoint
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Scope Name
Rzplnne.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rzplnne
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld jpil15qj11LfkQA9F2x jpil15qj11LfkQA9F2x::CmJqWkgnnY
call System.Void jpil15qj11LfkQA9F2x::a1FqIQyGku(jpil15qj11LfkQA9F2x)
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_a7396d6288954a219e03b14ec7f4583a
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld dI1aGuqXY0MVYG9dAse dI1aGuqXY0MVYG9dAse::guRqAmdkcZ
call System.Byte[] dI1aGuqXY0MVYG9dAse::a1FqIQyGku(dI1aGuqXY0MVYG9dAse)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_c14cd329839b4637a7eee2efe03b30d6
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -804123359
ldc.i4 -804123359
ldc.i4 -317790261
add <null>
ldc.i4 -862361938
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_566140e4f1ea432c8c561a1642591bc0
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
ldc.i4 -1051891054
ldc.i4 -788999537
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2c6dd7efd42e41068a7b964b3fbeaeaa
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
newobj System.Void ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld SP9xgrq3gy04GaOTDL3 SP9xgrq3gy04GaOTDL3::TUiqvVJ9TG
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok SP9xgrq3gy04GaOTDL3::a1FqIQyGku(System.Object,System.Byte[],SP9xgrq3gy04GaOTDL3)
ldsfld cTQqFVq9wKho7u0JPpx cTQqFVq9wKho7u0JPpx::kT6qGSY9wx
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok cTQqFVq9wKho7u0JPpx::a1FqIQyGku(System.Object,cTQqFVq9wKho7u0JPpx)
ldsfld qBhT47qovoXtCaC0stc qBhT47qovoXtCaC0stc::cb4qSKFU4W
call System.Void qBhT47qovoXtCaC0stc::a1FqIQyGku(System.Object,qBhT47qovoXtCaC0stc)
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_1782d22141fd4455a6826d0d710d31ae
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 5
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2245964cacce41389e5251bf6c907753
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 3
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_7d13e24880774f3c9b320e97eb4f14ba
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Rzplnne.exe
Full Name
Rzplnne.exe
EntryPoint
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Scope Name
Rzplnne.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rzplnne
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld jpil15qj11LfkQA9F2x jpil15qj11LfkQA9F2x::CmJqWkgnnY
call System.Void jpil15qj11LfkQA9F2x::a1FqIQyGku(jpil15qj11LfkQA9F2x)
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_a7396d6288954a219e03b14ec7f4583a
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld dI1aGuqXY0MVYG9dAse dI1aGuqXY0MVYG9dAse::guRqAmdkcZ
call System.Byte[] dI1aGuqXY0MVYG9dAse::a1FqIQyGku(dI1aGuqXY0MVYG9dAse)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_c14cd329839b4637a7eee2efe03b30d6
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -804123359
ldc.i4 -804123359
ldc.i4 -317790261
add <null>
ldc.i4 -862361938
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_566140e4f1ea432c8c561a1642591bc0
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
ldc.i4 -1051891054
ldc.i4 -788999537
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2c6dd7efd42e41068a7b964b3fbeaeaa
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
newobj System.Void ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld SP9xgrq3gy04GaOTDL3 SP9xgrq3gy04GaOTDL3::TUiqvVJ9TG
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok SP9xgrq3gy04GaOTDL3::a1FqIQyGku(System.Object,System.Byte[],SP9xgrq3gy04GaOTDL3)
ldsfld cTQqFVq9wKho7u0JPpx cTQqFVq9wKho7u0JPpx::kT6qGSY9wx
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok cTQqFVq9wKho7u0JPpx::a1FqIQyGku(System.Object,cTQqFVq9wKho7u0JPpx)
ldsfld qBhT47qovoXtCaC0stc qBhT47qovoXtCaC0stc::cb4qSKFU4W
call System.Void qBhT47qovoXtCaC0stc::a1FqIQyGku(System.Object,qBhT47qovoXtCaC0stc)
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_1782d22141fd4455a6826d0d710d31ae
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 5
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2245964cacce41389e5251bf6c907753
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 3
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_7d13e24880774f3c9b320e97eb4f14ba
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
1392491dacd81c37231a129db85d3208
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ue7x1xX2gHAsxKdb5J.oYZkuHAhoH1ucMLb7p
EY28hZjK7YC9YJR3nC.QEykq8Wyk4MV8KBOCO
YHiE7uxvLsrMrhUBLf.1JCtd3ProEmvj78IYW
9CxUGir5bwqI5Uirrw.Z0lstV5ybJrhFrDgua
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙