Malicious
Malicious

154874f9b722bc699bc503dd1469be87

Share on LinkedIn
Print
PE Executable
MD5: 154874f9b722bc699bc503dd1469be87
Size: 429.57 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 154874f9b722bc699bc503dd1469be87
Sha1 885a107f755eb39bfef53d887b6f008663e22567
Sha256 145a70dec0dc951f7cf55e10a755399773ae3d5bc9d38cfde6095cc88c7a3bb1
Sha384 24f95f67c8ea3cc470f47f2796cf148b29d9fbb4bb684cc90baba195faba509feb2b4b7ac090b6d9350f26343486371b
Sha512 7de3da83f954ab82baf56c75b0e7e04887f8381fc6c4702417cc9fa66e63a567e809f583e8961bd8706f147aafea3c53325ab33c5948949f3593e8cd913e9c1b
SSDeep 6144:kIiVFC/lnJDBgeNEiTvOYWt/9LlgftukHDL00lYjezowMabOOEz:KoJ9geNOYWdveXDRlYSzHVO
TLSH 89943A7A32914F21C24A1773C1C7590087E6964776ABFB0B328513DB2D863FEDA4B297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
154874f9b722bc699bc503dd1469be87
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
OeypHfdgEb3fQPV9dJ.3VyGgAGidlRhADGvB7
93n9AKn7Gi8Tbof4M7.06rYEVZvTDMpAO8O9A
abfiolr3IueXQw9x28.TPPwxm29doXoULYdB2
DAywVCRK6fKZWScA9N.WG3uWVoqYY3wSmH1gM
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tychdest.exe
Full Name
Tychdest.exe
EntryPoint
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Scope Name
Tychdest.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tychdest
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld H1BRkthrGvraqAZRDWD H1BRkthrGvraqAZRDWD::AJAh27DrtR
call System.Void H1BRkthrGvraqAZRDWD::LgShP7jxSD(H1BRkthrGvraqAZRDWD)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_8bda6b4f7418414bb789aed4873c9595
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld g3gNWwhnZxGkcEjqVYi g3gNWwhnZxGkcEjqVYi::URlhZmjaLn
call System.Byte[] g3gNWwhnZxGkcEjqVYi::LgShP7jxSD(g3gNWwhnZxGkcEjqVYi)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_0f2c928ad48e4ee796f96aa36d037267
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -566800915
ldc.i4 -566800915
ldc.i4 2
shr <null>
ldc.i4 -1174759506
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_e99f997b0833487dbdfa255e73eaddc9
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
ldc.i4 1596471055
ldc.i4 1011865070
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7a48f364f7b546aabaafd96b43852165
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
newobj System.Void hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Rkdrc8hWKZ30RFqAJhh Rkdrc8hWKZ30RFqAJhh::PFChqQfXbU
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh Rkdrc8hWKZ30RFqAJhh::LgShP7jxSD(System.Object,System.Byte[],Rkdrc8hWKZ30RFqAJhh)
ldsfld AxuSFIhDcMvLqJ7aDQW AxuSFIhDcMvLqJ7aDQW::lNHhVUUW2K
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh AxuSFIhDcMvLqJ7aDQW::LgShP7jxSD(System.Object,AxuSFIhDcMvLqJ7aDQW)
ldsfld yCcKkEhJLXaYVuJkgB9 yCcKkEhJLXaYVuJkgB9::KhQhMDOwA1
call System.Void yCcKkEhJLXaYVuJkgB9::LgShP7jxSD(System.Object,yCcKkEhJLXaYVuJkgB9)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7cc8a0d16d634de096609cb1d4f6765a
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_f4ea07a078914de298549e70c32274b7
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 2
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_d27324cb456143188efb6deb41970671
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Tychdest.exe
Full Name
Tychdest.exe
EntryPoint
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Scope Name
Tychdest.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tychdest
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void eOiLBU5HCxg4l5vtAi.E7c5h0hPlhKELDFFjw::DGdWq6PWL()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ret <null>
ldsfld H1BRkthrGvraqAZRDWD H1BRkthrGvraqAZRDWD::AJAh27DrtR
call System.Void H1BRkthrGvraqAZRDWD::LgShP7jxSD(H1BRkthrGvraqAZRDWD)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_8bda6b4f7418414bb789aed4873c9595
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld g3gNWwhnZxGkcEjqVYi g3gNWwhnZxGkcEjqVYi::URlhZmjaLn
call System.Byte[] g3gNWwhnZxGkcEjqVYi::LgShP7jxSD(g3gNWwhnZxGkcEjqVYi)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_0f2c928ad48e4ee796f96aa36d037267
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 -566800915
ldc.i4 -566800915
ldc.i4 2
shr <null>
ldc.i4 -1174759506
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_e99f997b0833487dbdfa255e73eaddc9
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
ldc.i4 1596471055
ldc.i4 1011865070
xor <null>
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7a48f364f7b546aabaafd96b43852165
xor <null>
ldsfld Y0aDm4hhGtIHGuw1Fbg Y0aDm4hhGtIHGuw1Fbg::nLXh5kujYm
call System.String Y0aDm4hhGtIHGuw1Fbg::LgShP7jxSD(System.Int32,Y0aDm4hhGtIHGuw1Fbg)
newobj System.Void hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Rkdrc8hWKZ30RFqAJhh Rkdrc8hWKZ30RFqAJhh::PFChqQfXbU
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh Rkdrc8hWKZ30RFqAJhh::LgShP7jxSD(System.Object,System.Byte[],Rkdrc8hWKZ30RFqAJhh)
ldsfld AxuSFIhDcMvLqJ7aDQW AxuSFIhDcMvLqJ7aDQW::lNHhVUUW2K
call hUBdbCRjpKf3AuU3b0k.CFLNMcRPV9cv3dk11Zh AxuSFIhDcMvLqJ7aDQW::LgShP7jxSD(System.Object,AxuSFIhDcMvLqJ7aDQW)
ldsfld yCcKkEhJLXaYVuJkgB9 yCcKkEhJLXaYVuJkgB9::KhQhMDOwA1
call System.Void yCcKkEhJLXaYVuJkgB9::LgShP7jxSD(System.Object,yCcKkEhJLXaYVuJkgB9)
ldc.i4 1
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_7cc8a0d16d634de096609cb1d4f6765a
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_f4ea07a078914de298549e70c32274b7
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 2
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c} <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_1bed2c96fc264e8bad9007b958bd4428
ldfld System.Int32 <Module>{78ec96a9-7ade-4a10-a383-cd68567c331c}::m_d27324cb456143188efb6deb41970671
brtrue IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙