Malicious
Malicious

1392491dacd81c37231a129db85d3208

Share on LinkedIn
Print
PE Executable
MD5: 1392491dacd81c37231a129db85d3208
Size: 1.04 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 1392491dacd81c37231a129db85d3208
Sha1 09a0c4332c5d4b2df1fc8c04a9668467997fe115
Sha256 46f61eee6e2ab0bbbb1872139ea56d87c2427bd4fbfc540329fdc7530914a160
Sha384 dde73a506de3aa70948a66901434487b9b6a6788118f449f4e2da470892e8a61f055502c461c3c3fa467c0d00ece2aab
Sha512 42a5e1809d9a92829b2a46b1b1a65fd439989187dd61befc93a7e7ee8cdee22e8be0ed63820f2d8ce77e63fc8598000aea97fa5bca5ea892ba189b3cc981a479
SSDeep 12288:4qZjP/ZO2SvYaoy7YWwBEHyTMk7XQx+Lc2+EbI7nPobG3PG1SEUQ4kMBVMY:FkHA87yBI8fS+t+EbILXO1hUj0Y
TLSH 3825CF2A72854E25D146A272D6C7C53143A55E076A97F30B31C42BEB3D8A3FECE46387
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1392491dacd81c37231a129db85d3208
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ue7x1xX2gHAsxKdb5J.oYZkuHAhoH1ucMLb7p
EY28hZjK7YC9YJR3nC.QEykq8Wyk4MV8KBOCO
YHiE7uxvLsrMrhUBLf.1JCtd3ProEmvj78IYW
9CxUGir5bwqI5Uirrw.Z0lstV5ybJrhFrDgua
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rzplnne.exe
Full Name
Rzplnne.exe
EntryPoint
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Scope Name
Rzplnne.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rzplnne
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld jpil15qj11LfkQA9F2x jpil15qj11LfkQA9F2x::CmJqWkgnnY
call System.Void jpil15qj11LfkQA9F2x::a1FqIQyGku(jpil15qj11LfkQA9F2x)
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_a7396d6288954a219e03b14ec7f4583a
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld dI1aGuqXY0MVYG9dAse dI1aGuqXY0MVYG9dAse::guRqAmdkcZ
call System.Byte[] dI1aGuqXY0MVYG9dAse::a1FqIQyGku(dI1aGuqXY0MVYG9dAse)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_c14cd329839b4637a7eee2efe03b30d6
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -804123359
ldc.i4 -804123359
ldc.i4 -317790261
add <null>
ldc.i4 -862361938
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_566140e4f1ea432c8c561a1642591bc0
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
ldc.i4 -1051891054
ldc.i4 -788999537
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2c6dd7efd42e41068a7b964b3fbeaeaa
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
newobj System.Void ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld SP9xgrq3gy04GaOTDL3 SP9xgrq3gy04GaOTDL3::TUiqvVJ9TG
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok SP9xgrq3gy04GaOTDL3::a1FqIQyGku(System.Object,System.Byte[],SP9xgrq3gy04GaOTDL3)
ldsfld cTQqFVq9wKho7u0JPpx cTQqFVq9wKho7u0JPpx::kT6qGSY9wx
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok cTQqFVq9wKho7u0JPpx::a1FqIQyGku(System.Object,cTQqFVq9wKho7u0JPpx)
ldsfld qBhT47qovoXtCaC0stc qBhT47qovoXtCaC0stc::cb4qSKFU4W
call System.Void qBhT47qovoXtCaC0stc::a1FqIQyGku(System.Object,qBhT47qovoXtCaC0stc)
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_1782d22141fd4455a6826d0d710d31ae
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 5
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2245964cacce41389e5251bf6c907753
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 3
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_7d13e24880774f3c9b320e97eb4f14ba
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Rzplnne.exe
Full Name
Rzplnne.exe
EntryPoint
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Scope Name
Rzplnne.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rzplnne
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void W3n2Xy0eAoqkXYgJ0Z.Ymm7FXqZcJPRMOpBGi::Mps32lOtN()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld jpil15qj11LfkQA9F2x jpil15qj11LfkQA9F2x::CmJqWkgnnY
call System.Void jpil15qj11LfkQA9F2x::a1FqIQyGku(jpil15qj11LfkQA9F2x)
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_a7396d6288954a219e03b14ec7f4583a
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld dI1aGuqXY0MVYG9dAse dI1aGuqXY0MVYG9dAse::guRqAmdkcZ
call System.Byte[] dI1aGuqXY0MVYG9dAse::a1FqIQyGku(dI1aGuqXY0MVYG9dAse)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_c14cd329839b4637a7eee2efe03b30d6
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -804123359
ldc.i4 -804123359
ldc.i4 -317790261
add <null>
ldc.i4 -862361938
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_566140e4f1ea432c8c561a1642591bc0
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
ldc.i4 -1051891054
ldc.i4 -788999537
xor <null>
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2c6dd7efd42e41068a7b964b3fbeaeaa
xor <null>
ldsfld uTRrXUqqe8HgIkYAO0X uTRrXUqqe8HgIkYAO0X::BwZq0wx3bl
call System.String uTRrXUqqe8HgIkYAO0X::a1FqIQyGku(System.Int32,uTRrXUqqe8HgIkYAO0X)
newobj System.Void ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld SP9xgrq3gy04GaOTDL3 SP9xgrq3gy04GaOTDL3::TUiqvVJ9TG
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok SP9xgrq3gy04GaOTDL3::a1FqIQyGku(System.Object,System.Byte[],SP9xgrq3gy04GaOTDL3)
ldsfld cTQqFVq9wKho7u0JPpx cTQqFVq9wKho7u0JPpx::kT6qGSY9wx
call ovxUyPr75gemqDJ5tn6.t7jEKSrIaEVfCmA12Ok cTQqFVq9wKho7u0JPpx::a1FqIQyGku(System.Object,cTQqFVq9wKho7u0JPpx)
ldsfld qBhT47qovoXtCaC0stc qBhT47qovoXtCaC0stc::cb4qSKFU4W
call System.Void qBhT47qovoXtCaC0stc::a1FqIQyGku(System.Object,qBhT47qovoXtCaC0stc)
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_1782d22141fd4455a6826d0d710d31ae
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 5
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_2245964cacce41389e5251bf6c907753
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 3
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 5
ldsfld <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89} <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_bab30005e6c24bb9947b81de1842e69d
ldfld System.Int32 <Module>{fb9366fd-aa18-4a16-8d68-b84fedf1ad89}::m_7d13e24880774f3c9b320e97eb4f14ba
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙