Malicious
Malicious

13aa55915fe8418214edc3f57138e29e

Share on LinkedIn
Print
PE Executable
MD5: 13aa55915fe8418214edc3f57138e29e
Size: 429.57 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 13aa55915fe8418214edc3f57138e29e
Sha1 1f0018007ed4f8c86b7954cdcb91b7081ae25afe
Sha256 5f2979cd7d8192bb50266546557be153907b952d73f911122655c79c9ba73591
Sha384 938d1e18cf86a742db8bbd9171faa279d375995364c8d66d0b67813ac5b545e4ab2acf51404a9345027944a6f500e72f
Sha512 c1cff940f50894e87a875ddc3e969b36f78dffcee9ab26a9d36347265b66ba02c40ee7842dda76aecb4d4f79342af19f90d4d6ba4fa544794ebad1a7d7f18b3b
SSDeep 6144:NBC+YXkcg+Qaqnwgmf+S14rFmvzxfD2cONhCvARr:5YZQhwgAd2FmvV2cOrCmr
TLSH C1943B3A36918E21C24A5373C5D7490087EB9A8777ABEB0B358423D60D473FEDE46297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
13aa55915fe8418214edc3f57138e29e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
XWq1gQWTc3P8sqePAD.iAleJIl2mjViYHPxgE
P7esv2eJR2bZwJLNpM.9qvvEOosNo4nmfmifF
cqEj3RPN2ycU1mxgAX.BmAr5fwcFIU2uandn9
1ZaBol3n4pa2r1wfaN.JeX7cnKepuR29LmZ5p
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Fhgrcufwb.exe
Full Name
Fhgrcufwb.exe
EntryPoint
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Scope Name
Fhgrcufwb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fhgrcufwb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld BfQjnMfW4to2AbUUtgF BfQjnMfW4to2AbUUtgF::WjvflLTem3
call System.Void BfQjnMfW4to2AbUUtgF::M2bfSXFlvH(BfQjnMfW4to2AbUUtgF)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TJtH24fPEKusS1To9pB TJtH24fPEKusS1To9pB::SJSfwAWq6N
call System.Byte[] TJtH24fPEKusS1To9pB::M2bfSXFlvH(TJtH24fPEKusS1To9pB)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_02dea13bc6ff4084a64cffc90231ca47
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0145)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_0145: leave IL_0061
ldc.i4 -457510009
not <null>
ldc.i4 1741315108
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
ldc.i4 703965558
ldc.i4 898015825
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_12e6cb575fd74b099405c51d4461e05c
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
newobj System.Void wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zHM2bAfUX0HLHVZvTGr zHM2bAfUX0HLHVZvTGr::uuvfp94C0B
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml zHM2bAfUX0HLHVZvTGr::M2bfSXFlvH(System.Object,System.Byte[],zHM2bAfUX0HLHVZvTGr)
ldsfld S1I4RvfRDePFu8i6Hqn S1I4RvfRDePFu8i6Hqn::qxqf62qK5L
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml S1I4RvfRDePFu8i6Hqn::M2bfSXFlvH(System.Object,S1I4RvfRDePFu8i6Hqn)
ldsfld w5DfT3fvLC9nMwITYly w5DfT3fvLC9nMwITYly::IF4fuxykvT
call System.Void w5DfT3fvLC9nMwITYly::M2bfSXFlvH(System.Object,w5DfT3fvLC9nMwITYly)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_a4b0d9bc5d6448e8808d79d81616c7a6
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_0145)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brfalse IL_017C: switch(IL_0198)
pop <null>
ldc.i4 5
br IL_017C: switch(IL_0198)
br IL_0178: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0178: ldloc V_0
br IL_0198: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Fhgrcufwb.exe
Full Name
Fhgrcufwb.exe
EntryPoint
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Scope Name
Fhgrcufwb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Fhgrcufwb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void L3pS4CnslQSA848Dqy.WNy9a5fTRfUEN4JUaS::hpeUmXxRC()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld BfQjnMfW4to2AbUUtgF BfQjnMfW4to2AbUUtgF::WjvflLTem3
call System.Void BfQjnMfW4to2AbUUtgF::M2bfSXFlvH(BfQjnMfW4to2AbUUtgF)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TJtH24fPEKusS1To9pB TJtH24fPEKusS1To9pB::SJSfwAWq6N
call System.Byte[] TJtH24fPEKusS1To9pB::M2bfSXFlvH(TJtH24fPEKusS1To9pB)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_02dea13bc6ff4084a64cffc90231ca47
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0145)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_0145: leave IL_0061
ldc.i4 -457510009
not <null>
ldc.i4 1741315108
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_994878973f764e90934131a7280dd3a4
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
ldc.i4 703965558
ldc.i4 898015825
xor <null>
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_12e6cb575fd74b099405c51d4461e05c
xor <null>
ldsfld YIBnuUfftwNIWf6TwCo YIBnuUfftwNIWf6TwCo::tC0fnXTkeH
call System.String YIBnuUfftwNIWf6TwCo::M2bfSXFlvH(System.Int32,YIBnuUfftwNIWf6TwCo)
newobj System.Void wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zHM2bAfUX0HLHVZvTGr zHM2bAfUX0HLHVZvTGr::uuvfp94C0B
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml zHM2bAfUX0HLHVZvTGr::M2bfSXFlvH(System.Object,System.Byte[],zHM2bAfUX0HLHVZvTGr)
ldsfld S1I4RvfRDePFu8i6Hqn S1I4RvfRDePFu8i6Hqn::qxqf62qK5L
call wlIPs83LXnyAbxmpZeM.UHCTVd3SSCGwIcxSjml S1I4RvfRDePFu8i6Hqn::M2bfSXFlvH(System.Object,S1I4RvfRDePFu8i6Hqn)
ldsfld w5DfT3fvLC9nMwITYly w5DfT3fvLC9nMwITYly::IF4fuxykvT
call System.Void w5DfT3fvLC9nMwITYly::M2bfSXFlvH(System.Object,w5DfT3fvLC9nMwITYly)
ldc.i4 1
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_a4b0d9bc5d6448e8808d79d81616c7a6
brfalse IL_00A0: switch(IL_00C0,IL_0145)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_0145)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brfalse IL_017C: switch(IL_0198)
pop <null>
ldc.i4 5
br IL_017C: switch(IL_0198)
br IL_0178: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0178: ldloc V_0
br IL_0198: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2} <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_bef272e2a7b44b64a49dd986cacdb1b2
ldfld System.Int32 <Module>{5d74a410-a35b-4c9f-9db2-67a358a9aea2}::m_52f249c062b544a1b3d85aa5e324a303
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙