Malicious
Malicious

148d43b07def3619cf07a1d440892e6f

Share on LinkedIn
Print
PE Executable
MD5: 148d43b07def3619cf07a1d440892e6f
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 148d43b07def3619cf07a1d440892e6f
Sha1 8883ff5ff4ba025a42255ce0fa45ce7bf5c2c146
Sha256 169fd9264d4e5b84e514cd34a0e69c2c56667393546434282f8957bc045a091e
Sha384 ea9b9b0a7011946b376c0f24efcbb587bf0df1d6e32303ec2711830f4d73b0e0887ec70e41943973eb02a6ac2bf61d75
Sha512 4662592875ab7e017a16175c4f62f206c4431629d301a53de0924b3f9abc8feb7588d974d7e6dddaae92ba33c880225a7aae0024ee4a4fe1f419f6e32358f606
SSDeep 12288:mVYRgXmDsQhL7jnOed4Q9HyEv+Cp3QMvJe+2Qrr/TijA7+:D+X2sQhvd4Q9HyEmChZR1rrmjs
TLSH 6B05BF2A72928E22D14A4773C1D7490087EA96477AABF70B328523D60D073FEDE476D7
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
148d43b07def3619cf07a1d440892e6f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DGCNFcAngr18WXrdsb.TDbvo1yP6mF7oDU8G4
AfIsFkd2BT1uBn6SZX.ZQLDhacqI3Aq6ghCnf
WFBwQleABKM4VhTLft.4wVLqlRTlMa0J0EIEJ
rhc9HwraOXiSUZ32fF.VGxiQLVYyKRe6HD4xX
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Aneozba.exe
Full Name
Aneozba.exe
EntryPoint
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Scope Name
Aneozba.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aneozba
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0062: nop
ldsfld r7VTqTNeL4ZDEmxinVF r7VTqTNeL4ZDEmxinVF::DNyNRdHZo8
call System.Void r7VTqTNeL4ZDEmxinVF::AauNFQ7JEH(r7VTqTNeL4ZDEmxinVF)
ldc.i4 0
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_7fbd9d2889b24e59af7dbbbb071bf266
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld qXSCZlNd8scafyx01Lw qXSCZlNd8scafyx01Lw::ODdNcgbwZ4
call System.Byte[] qXSCZlNd8scafyx01Lw::AauNFQ7JEH(qXSCZlNd8scafyx01Lw)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_1296bf3c3a31446cb210b470bd1a2816
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_014A: leave IL_0061
ldc.i4 -1313434922
ldc.i4 4
shr <null>
ldc.i4 -798598581
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_21d57e600b574d298b0280ac5854ff48
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
ldc.i4 1306283611
ldc.i4 593574171
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2d1bc83ec3ba4410a42e058338dd0f10
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
newobj System.Void RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld YDNWZMNPbAbTsjjxOLw YDNWZMNPbAbTsjjxOLw::uuENu48QYJ
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp YDNWZMNPbAbTsjjxOLw::AauNFQ7JEH(System.Object,System.Byte[],YDNWZMNPbAbTsjjxOLw)
ldsfld iCqsZHNKqFLCfoCAadb iCqsZHNKqFLCfoCAadb::phxNBq22dc
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp iCqsZHNKqFLCfoCAadb::AauNFQ7JEH(System.Object,iCqsZHNKqFLCfoCAadb)
ldsfld TlZ0qNN4psWtwkFnEWj TlZ0qNN4psWtwkFnEWj::c69NjigDYW
call System.Void TlZ0qNN4psWtwkFnEWj::AauNFQ7JEH(System.Object,TlZ0qNN4psWtwkFnEWj)
ldc.i4 7
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_4fe62cc45af14b4cba6c01a010e3440c
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_95867c1d933f467e9b2058acaba0bbd2
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2cf838a4fe494037aa5f11cc60ffea38
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Aneozba.exe
Full Name
Aneozba.exe
EntryPoint
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Scope Name
Aneozba.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Aneozba
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JJXQHXLLm9fYy4nAuU.HpgnDFNieiMrYK7DhA::QTHP0sUpp()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0062: nop
ldsfld r7VTqTNeL4ZDEmxinVF r7VTqTNeL4ZDEmxinVF::DNyNRdHZo8
call System.Void r7VTqTNeL4ZDEmxinVF::AauNFQ7JEH(r7VTqTNeL4ZDEmxinVF)
ldc.i4 0
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_7fbd9d2889b24e59af7dbbbb071bf266
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld qXSCZlNd8scafyx01Lw qXSCZlNd8scafyx01Lw::ODdNcgbwZ4
call System.Byte[] qXSCZlNd8scafyx01Lw::AauNFQ7JEH(qXSCZlNd8scafyx01Lw)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_1296bf3c3a31446cb210b470bd1a2816
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_014A: leave IL_0061
ldc.i4 -1313434922
ldc.i4 4
shr <null>
ldc.i4 -798598581
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_21d57e600b574d298b0280ac5854ff48
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
ldc.i4 1306283611
ldc.i4 593574171
xor <null>
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2d1bc83ec3ba4410a42e058338dd0f10
xor <null>
ldsfld OiIV0pNNt3EG7YbVxZt OiIV0pNNt3EG7YbVxZt::d2jNLc090O
call System.String OiIV0pNNt3EG7YbVxZt::AauNFQ7JEH(System.Int32,OiIV0pNNt3EG7YbVxZt)
newobj System.Void RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld YDNWZMNPbAbTsjjxOLw YDNWZMNPbAbTsjjxOLw::uuENu48QYJ
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp YDNWZMNPbAbTsjjxOLw::AauNFQ7JEH(System.Object,System.Byte[],YDNWZMNPbAbTsjjxOLw)
ldsfld iCqsZHNKqFLCfoCAadb iCqsZHNKqFLCfoCAadb::phxNBq22dc
call RugKb3r3Z1vfNYhTKF1.qFTTWZrFh0VUex6B9Pp iCqsZHNKqFLCfoCAadb::AauNFQ7JEH(System.Object,iCqsZHNKqFLCfoCAadb)
ldsfld TlZ0qNN4psWtwkFnEWj TlZ0qNN4psWtwkFnEWj::c69NjigDYW
call System.Void TlZ0qNN4psWtwkFnEWj::AauNFQ7JEH(System.Object,TlZ0qNN4psWtwkFnEWj)
ldc.i4 7
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_4fe62cc45af14b4cba6c01a010e3440c
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_95867c1d933f467e9b2058acaba0bbd2
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 4
ldsfld <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61} <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_610ee13e853742e7a579f80ca836c153
ldfld System.Int32 <Module>{7426eac4-1bd0-4018-bdf9-4a32c18a2a61}::m_2cf838a4fe494037aa5f11cc60ffea38
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙