Malicious
Malicious

148d43b07def3619cf07a1d440892e6f

PE Executable
MD5: 148d43b07def3619cf07a1d440892e6f
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 148d43b07def3619cf07a1d440892e6f
Sha1 8883ff5ff4ba025a42255ce0fa45ce7bf5c2c146
Sha256 169fd9264d4e5b84e514cd34a0e69c2c56667393546434282f8957bc045a091e
Sha384 ea9b9b0a7011946b376c0f24efcbb587bf0df1d6e32303ec2711830f4d73b0e0887ec70e41943973eb02a6ac2bf61d75
Sha512 4662592875ab7e017a16175c4f62f206c4431629d301a53de0924b3f9abc8feb7588d974d7e6dddaae92ba33c880225a7aae0024ee4a4fe1f419f6e32358f606
SSDeep 12288:mVYRgXmDsQhL7jnOed4Q9HyEv+Cp3QMvJe+2Qrr/TijA7+:D+X2sQhvd4Q9HyEmChZR1rrmjs
TLSH 6B05BF2A72928E22D14A4773C1D7490087EA96477AABF70B328523D60D073FEDE476D7
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
148d43b07def3619cf07a1d440892e6f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DGCNFcAngr18WXrdsb.TDbvo1yP6mF7oDU8G4
AfIsFkd2BT1uBn6SZX.ZQLDhacqI3Aq6ghCnf
WFBwQleABKM4VhTLft.4wVLqlRTlMa0J0EIEJ
rhc9HwraOXiSUZ32fF.VGxiQLVYyKRe6HD4xX
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Aneozba.exe
Full Name
Aneozba.exe
EntryPoint
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Scope Name
Aneozba.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aneozba
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0062: nop
ldsfld r7VTqTNeL4ZDEmxinVF r7VTqTNeL4ZDEmxinVF::DNyNRdHZo8
call System.Void r7VTqTNeL4ZDEmxinVF::AauNFQ7JEH(r7VTqTNeL4ZDEmxinVF)
ldc.i4 0
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_7fbd9d2889b24e59af7dbbbb071bf266
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld qXSCZlNd8scafyx01Lw qXSCZlNd8scafyx01Lw::ODdNcgbwZ4
call System.Byte[] qXSCZlNd8scafyx01Lw::AauNFQ7JEH(qXSCZlNd8scafyx01Lw)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_1296bf3c3a31446cb210b470bd1a2816
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_014A: leave IL_0061
ldc.i4 -1313434922
ldc.i4 4
shr <null>
ldc.i4 -798598581
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_21d57e600b574d298b0280ac5854ff48
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
ldc.i4 1306283611
ldc.i4 593574171
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2d1bc83ec3ba4410a42e058338dd0f10
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
newobj System.Void RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld YDNWZMNPbAbTsjjxOLw YDNWZMNPbAbTsjjxOLw::uuENu48QYJ
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp YDNWZMNPbAbTsjjxOLw::AauNFQ7JEH(System.Object,System.Byte[],YDNWZMNPbAbTsjjxOLw)
ldsfld iCqsZHNKqFLCfoCAadb iCqsZHNKqFLCfoCAadb::phxNBq22dc
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp iCqsZHNKqFLCfoCAadb::AauNFQ7JEH(System.Object,iCqsZHNKqFLCfoCAadb)
ldsfld TlZ0qNN4psWtwkFnEWj TlZ0qNN4psWtwkFnEWj::c69NjigDYW
call System.Void TlZ0qNN4psWtwkFnEWj::AauNFQ7JEH(System.Object,TlZ0qNN4psWtwkFnEWj)
ldc.i4 7
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_4fe62cc45af14b4cba6c01a010e3440c
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_95867c1d933f467e9b2058acaba0bbd2
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2cf838a4fe494037aa5f11cc60ffea38
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Aneozba.exe
Full Name
Aneozba.exe
EntryPoint
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Scope Name
Aneozba.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aneozba
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0062: nop
ldsfld r7VTqTNeL4ZDEmxinVF r7VTqTNeL4ZDEmxinVF::DNyNRdHZo8
call System.Void r7VTqTNeL4ZDEmxinVF::AauNFQ7JEH(r7VTqTNeL4ZDEmxinVF)
ldc.i4 0
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_7fbd9d2889b24e59af7dbbbb071bf266
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld qXSCZlNd8scafyx01Lw qXSCZlNd8scafyx01Lw::ODdNcgbwZ4
call System.Byte[] qXSCZlNd8scafyx01Lw::AauNFQ7JEH(qXSCZlNd8scafyx01Lw)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_1296bf3c3a31446cb210b470bd1a2816
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_014A: leave IL_0061
ldc.i4 -1313434922
ldc.i4 4
shr <null>
ldc.i4 -798598581
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_21d57e600b574d298b0280ac5854ff48
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
ldc.i4 1306283611
ldc.i4 593574171
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2d1bc83ec3ba4410a42e058338dd0f10
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
newobj System.Void RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld YDNWZMNPbAbTsjjxOLw YDNWZMNPbAbTsjjxOLw::uuENu48QYJ
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp YDNWZMNPbAbTsjjxOLw::AauNFQ7JEH(System.Object,System.Byte[],YDNWZMNPbAbTsjjxOLw)
ldsfld iCqsZHNKqFLCfoCAadb iCqsZHNKqFLCfoCAadb::phxNBq22dc
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp iCqsZHNKqFLCfoCAadb::AauNFQ7JEH(System.Object,iCqsZHNKqFLCfoCAadb)
ldsfld TlZ0qNN4psWtwkFnEWj TlZ0qNN4psWtwkFnEWj::c69NjigDYW
call System.Void TlZ0qNN4psWtwkFnEWj::AauNFQ7JEH(System.Object,TlZ0qNN4psWtwkFnEWj)
ldc.i4 7
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_4fe62cc45af14b4cba6c01a010e3440c
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_95867c1d933f467e9b2058acaba0bbd2
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2cf838a4fe494037aa5f11cc60ffea38
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
148d43b07def3619cf07a1d440892e6f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DGCNFcAngr18WXrdsb.TDbvo1yP6mF7oDU8G4
AfIsFkd2BT1uBn6SZX.ZQLDhacqI3Aq6ghCnf
WFBwQleABKM4VhTLft.4wVLqlRTlMa0J0EIEJ
rhc9HwraOXiSUZ32fF.VGxiQLVYyKRe6HD4xX
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙