Malicious
Malicious

154874f9b722bc699bc503dd1469be87

PE Executable
MD5: 154874f9b722bc699bc503dd1469be87
Size: 429.57 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 154874f9b722bc699bc503dd1469be87
Sha1 885a107f755eb39bfef53d887b6f008663e22567
Sha256 145a70dec0dc951f7cf55e10a755399773ae3d5bc9d38cfde6095cc88c7a3bb1
Sha384 24f95f67c8ea3cc470f47f2796cf148b29d9fbb4bb684cc90baba195faba509feb2b4b7ac090b6d9350f26343486371b
Sha512 7de3da83f954ab82baf56c75b0e7e04887f8381fc6c4702417cc9fa66e63a567e809f583e8961bd8706f147aafea3c53325ab33c5948949f3593e8cd913e9c1b
SSDeep 6144:kIiVFC/lnJDBgeNEiTvOYWt/9LlgftukHDL00lYjezowMabOOEz:KoJ9geNOYWdveXDRlYSzHVO
TLSH 89943A7A32914F21C24A1773C1C7590087E6964776ABFB0B328513DB2D863FEDA4B297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
154874f9b722bc699bc503dd1469be87
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
OeypHfdgEb3fQPV9dJ.3VyGgAGidlRhADGvB7
93n9AKn7Gi8Tbof4M7.06rYEVZvTDMpAO8O9A
abfiolr3IueXQw9x28.TPPwxm29doXoULYdB2
DAywVCRK6fKZWScA9N.WG3uWVoqYY3wSmH1gM
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tychdest.exe
Full Name
Tychdest.exe
EntryPoint
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Scope Name
Tychdest.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tychdest
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld H1BRkthrGvraqAZRDWD H1BRkthrGvraqAZRDWD::AJAh27DrtR
call System.Void H1BRkthrGvraqAZRDWD::LgShP7jxSD(H1BRkthrGvraqAZRDWD)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_8bda6b4f7418414bb789aed4873c9595
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld g3gNWwhnZxGkcEjqVYi g3gNWwhnZxGkcEjqVYi::URlhZmjaLn
call System.Byte[] g3gNWwhnZxGkcEjqVYi::LgShP7jxSD(g3gNWwhnZxGkcEjqVYi)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_0f2c928ad48e4ee796f96aa36d037267
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -566800915
ldc.i4 -566800915
ldc.i4 2
shr <null>
ldc.i4 -1174759506
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_e99f997b0833487dbdfa255e73eaddc9
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
ldc.i4 1596471055
ldc.i4 1011865070
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7a48f364f7b546aabaafd96b43852165
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
newobj System.Void hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Rkdrc8hWKZ30RFqAJhh Rkdrc8hWKZ30RFqAJhh::PFChqQfXbU
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh Rkdrc8hWKZ30RFqAJhh::LgShP7jxSD(System.Object,System.Byte[],Rkdrc8hWKZ30RFqAJhh)
ldsfld AxuSFIhDcMvLqJ7aDQW AxuSFIhDcMvLqJ7aDQW::lNHhVUUW2K
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh AxuSFIhDcMvLqJ7aDQW::LgShP7jxSD(System.Object,AxuSFIhDcMvLqJ7aDQW)
ldsfld yCcKkEhJLXaYVuJkgB9 yCcKkEhJLXaYVuJkgB9::KhQhMDOwA1
call System.Void yCcKkEhJLXaYVuJkgB9::LgShP7jxSD(System.Object,yCcKkEhJLXaYVuJkgB9)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7cc8a0d16d634de096609cb1d4f6765a
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_f4ea07a078914de298549e70c32274b7
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 2
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_d27324cb456143188efb6deb41970671
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Tychdest.exe
Full Name
Tychdest.exe
EntryPoint
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Scope Name
Tychdest.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tychdest
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld H1BRkthrGvraqAZRDWD H1BRkthrGvraqAZRDWD::AJAh27DrtR
call System.Void H1BRkthrGvraqAZRDWD::LgShP7jxSD(H1BRkthrGvraqAZRDWD)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_8bda6b4f7418414bb789aed4873c9595
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld g3gNWwhnZxGkcEjqVYi g3gNWwhnZxGkcEjqVYi::URlhZmjaLn
call System.Byte[] g3gNWwhnZxGkcEjqVYi::LgShP7jxSD(g3gNWwhnZxGkcEjqVYi)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_0f2c928ad48e4ee796f96aa36d037267
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -566800915
ldc.i4 -566800915
ldc.i4 2
shr <null>
ldc.i4 -1174759506
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_e99f997b0833487dbdfa255e73eaddc9
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
ldc.i4 1596471055
ldc.i4 1011865070
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7a48f364f7b546aabaafd96b43852165
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
newobj System.Void hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Rkdrc8hWKZ30RFqAJhh Rkdrc8hWKZ30RFqAJhh::PFChqQfXbU
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh Rkdrc8hWKZ30RFqAJhh::LgShP7jxSD(System.Object,System.Byte[],Rkdrc8hWKZ30RFqAJhh)
ldsfld AxuSFIhDcMvLqJ7aDQW AxuSFIhDcMvLqJ7aDQW::lNHhVUUW2K
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh AxuSFIhDcMvLqJ7aDQW::LgShP7jxSD(System.Object,AxuSFIhDcMvLqJ7aDQW)
ldsfld yCcKkEhJLXaYVuJkgB9 yCcKkEhJLXaYVuJkgB9::KhQhMDOwA1
call System.Void yCcKkEhJLXaYVuJkgB9::LgShP7jxSD(System.Object,yCcKkEhJLXaYVuJkgB9)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7cc8a0d16d634de096609cb1d4f6765a
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_f4ea07a078914de298549e70c32274b7
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 2
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_d27324cb456143188efb6deb41970671
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
154874f9b722bc699bc503dd1469be87
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
OeypHfdgEb3fQPV9dJ.3VyGgAGidlRhADGvB7
93n9AKn7Gi8Tbof4M7.06rYEVZvTDMpAO8O9A
abfiolr3IueXQw9x28.TPPwxm29doXoULYdB2
DAywVCRK6fKZWScA9N.WG3uWVoqYY3wSmH1gM
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙