Malicious
Malicious

13aa55915fe8418214edc3f57138e29e

PE Executable
MD5: 13aa55915fe8418214edc3f57138e29e
Size: 429.57 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 13aa55915fe8418214edc3f57138e29e
Sha1 1f0018007ed4f8c86b7954cdcb91b7081ae25afe
Sha256 5f2979cd7d8192bb50266546557be153907b952d73f911122655c79c9ba73591
Sha384 938d1e18cf86a742db8bbd9171faa279d375995364c8d66d0b67813ac5b545e4ab2acf51404a9345027944a6f500e72f
Sha512 c1cff940f50894e87a875ddc3e969b36f78dffcee9ab26a9d36347265b66ba02c40ee7842dda76aecb4d4f79342af19f90d4d6ba4fa544794ebad1a7d7f18b3b
SSDeep 6144:NBC+YXkcg+Qaqnwgmf+S14rFmvzxfD2cONhCvARr:5YZQhwgAd2FmvV2cOrCmr
TLSH C1943B3A36918E21C24A5373C5D7490087EB9A8777ABEB0B358423D60D473FEDE46297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
13aa55915fe8418214edc3f57138e29e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
XWq1gQWTc3P8sqePAD.iAleJIl2mjViYHPxgE
P7esv2eJR2bZwJLNpM.9qvvEOosNo4nmfmifF
cqEj3RPN2ycU1mxgAX.BmAr5fwcFIU2uandn9
1ZaBol3n4pa2r1wfaN.JeX7cnKepuR29LmZ5p
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Fhgrcufwb.exe
Full Name
Fhgrcufwb.exe
EntryPoint
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Scope Name
Fhgrcufwb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fhgrcufwb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld BfQjnMfW4to2AbUUtgF BfQjnMfW4to2AbUUtgF::WjvflLTem3
call System.Void BfQjnMfW4to2AbUUtgF::M2bfSXFlvH(BfQjnMfW4to2AbUUtgF)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TJtH24fPEKusS1To9pB TJtH24fPEKusS1To9pB::SJSfwAWq6N
call System.Byte[] TJtH24fPEKusS1To9pB::M2bfSXFlvH(TJtH24fPEKusS1To9pB)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_02dea13bc6ff4084a64cffc90231ca47
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0145)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_0145: leave IL_0061
ldc.i4 -457510009
not <null>
ldc.i4 1741315108
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
ldc.i4 703965558
ldc.i4 898015825
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_12e6cb575fd74b099405c51d4461e05c
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
newobj System.Void wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zHM2bAfUX0HLHVZvTGr zHM2bAfUX0HLHVZvTGr::uuvfp94C0B
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml zHM2bAfUX0HLHVZvTGr::M2bfSXFlvH(System.Object,System.Byte[],zHM2bAfUX0HLHVZvTGr)
ldsfld S1I4RvfRDePFu8i6Hqn S1I4RvfRDePFu8i6Hqn::qxqf62qK5L
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml S1I4RvfRDePFu8i6Hqn::M2bfSXFlvH(System.Object,S1I4RvfRDePFu8i6Hqn)
ldsfld w5DfT3fvLC9nMwITYly w5DfT3fvLC9nMwITYly::IF4fuxykvT
call System.Void w5DfT3fvLC9nMwITYly::M2bfSXFlvH(System.Object,w5DfT3fvLC9nMwITYly)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_a4b0d9bc5d6448e8808d79d81616c7a6
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_0145)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brfalse IL_017C: switch(IL_0198)
pop <null>
ldc.i4 5
br IL_017C: switch(IL_0198)
br IL_0178: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0178: ldloc V_0
br IL_0198: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Fhgrcufwb.exe
Full Name
Fhgrcufwb.exe
EntryPoint
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Scope Name
Fhgrcufwb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fhgrcufwb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld BfQjnMfW4to2AbUUtgF BfQjnMfW4to2AbUUtgF::WjvflLTem3
call System.Void BfQjnMfW4to2AbUUtgF::M2bfSXFlvH(BfQjnMfW4to2AbUUtgF)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TJtH24fPEKusS1To9pB TJtH24fPEKusS1To9pB::SJSfwAWq6N
call System.Byte[] TJtH24fPEKusS1To9pB::M2bfSXFlvH(TJtH24fPEKusS1To9pB)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_02dea13bc6ff4084a64cffc90231ca47
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0145)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_0145: leave IL_0061
ldc.i4 -457510009
not <null>
ldc.i4 1741315108
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
ldc.i4 703965558
ldc.i4 898015825
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_12e6cb575fd74b099405c51d4461e05c
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
newobj System.Void wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zHM2bAfUX0HLHVZvTGr zHM2bAfUX0HLHVZvTGr::uuvfp94C0B
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml zHM2bAfUX0HLHVZvTGr::M2bfSXFlvH(System.Object,System.Byte[],zHM2bAfUX0HLHVZvTGr)
ldsfld S1I4RvfRDePFu8i6Hqn S1I4RvfRDePFu8i6Hqn::qxqf62qK5L
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml S1I4RvfRDePFu8i6Hqn::M2bfSXFlvH(System.Object,S1I4RvfRDePFu8i6Hqn)
ldsfld w5DfT3fvLC9nMwITYly w5DfT3fvLC9nMwITYly::IF4fuxykvT
call System.Void w5DfT3fvLC9nMwITYly::M2bfSXFlvH(System.Object,w5DfT3fvLC9nMwITYly)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_a4b0d9bc5d6448e8808d79d81616c7a6
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_0145)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brfalse IL_017C: switch(IL_0198)
pop <null>
ldc.i4 5
br IL_017C: switch(IL_0198)
br IL_0178: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0178: ldloc V_0
br IL_0198: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
13aa55915fe8418214edc3f57138e29e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
XWq1gQWTc3P8sqePAD.iAleJIl2mjViYHPxgE
P7esv2eJR2bZwJLNpM.9qvvEOosNo4nmfmifF
cqEj3RPN2ycU1mxgAX.BmAr5fwcFIU2uandn9
1ZaBol3n4pa2r1wfaN.JeX7cnKepuR29LmZ5p
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙