Malicious
Malicious

15742024eec468767a0b6bdf96085c20

PE Executable
MD5: 15742024eec468767a0b6bdf96085c20
Size: 827.9 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 15742024eec468767a0b6bdf96085c20
Sha1 05ac6fa423372e3095b06adb6712178b888b2c60
Sha256 c42130f2f9f1fc1a1c4189b6cc3bc5ce0207d21620e20cc4119ae86951105344
Sha384 f4ab41d6a693ecaa9dc4ca54ffed4d8bfef59d261fc1acae1ce8a017423dbf3a61e380fadf3127d98209c0ead6fee22b
Sha512 097ff36ec693580d44c2cc54e712beab23cc3b83bc7a622769dafb45224fa1aaab7b02e518eeea0f6e36f1b1ef54dfeb33c33acff32628c279b04f42ea330030
SSDeep 12288:krkBxIfN1V/tlP31P/CqwsFwUT6j0c0VapxK2zbXSLQv/Hdk9aJrjBuzj8aSIlTT:qD1B1nCqdT6jBZHzL/Hdk9Ijcz6Izh
TLSH BC05BE7B32914F21C24A2377C1C74900C7AA9A87B6EBEB0B718503D61D067FEDE46697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
15742024eec468767a0b6bdf96085c20
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uxTIErxRSN3oGhGR8e.JnlTXqQcOJy5VY2MkH
OF9RYKZZ1ZaFAG5JHG.M4S1ZUpqWVHxXPF32r
F2kaMj51aON9RmPbOP.UuNa12UuY9dc6y6v68
mTAd7UyND0ypXjcILy.mGuGMG2HemvpDX6oWC
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ivltcndzfyw.exe
Full Name
Ivltcndzfyw.exe
EntryPoint
System.Void aZZSMjHK9uDeK8svOn.DuMHnrrYr0b0buCsUF::iqXAGVPy4()
Scope Name
Ivltcndzfyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ivltcndzfyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aZZSMjHK9uDeK8svOn.DuMHnrrYr0b0buCsUF::iqXAGVPy4()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0192: ldsfld qIHJ0ar5lbIsEVpYgHF qIHJ0ar5lbIsEVpYgHF::EWKrURKxuh
nop <null>
ldsfld D34wdXrZQ1uJpSLgkVe D34wdXrZQ1uJpSLgkVe::awPrpaXmbj
call System.Byte[] D34wdXrZQ1uJpSLgkVe::HO9rt9bRol(D34wdXrZQ1uJpSLgkVe)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_1753d32b1940400d99719debf14a5879
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 1398810587
ldc.i4 1338824378
xor <null>
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_21d7eed98e8948b588e175eebc50f9cb
xor <null>
ldsfld q2cdyQrrJI8oU19RWxJ q2cdyQrrJI8oU19RWxJ::nvorHDlYmE
call System.String q2cdyQrrJI8oU19RWxJ::HO9rt9bRol(System.Int32,q2cdyQrrJI8oU19RWxJ)
ldc.i4 1920191706
ldc.i4 392214455
xor <null>
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_6f6972368e554452a3765bb00d487eb3
xor <null>
ldsfld q2cdyQrrJI8oU19RWxJ q2cdyQrrJI8oU19RWxJ::nvorHDlYmE
call System.String q2cdyQrrJI8oU19RWxJ::HO9rt9bRol(System.Int32,q2cdyQrrJI8oU19RWxJ)
newobj System.Void HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld wXAZNvrAdeDQt4TNDYr wXAZNvrAdeDQt4TNDYr::f72rcTasv5
call HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB wXAZNvrAdeDQt4TNDYr::HO9rt9bRol(System.Object,System.Byte[],wXAZNvrAdeDQt4TNDYr)
ldsfld vjQjTCrNi587SjGyCqc vjQjTCrNi587SjGyCqc::ThkrgHqOVU
call HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB vjQjTCrNi587SjGyCqc::HO9rt9bRol(System.Object,vjQjTCrNi587SjGyCqc)
ldsfld WYoafwrhd40rc28bNK2 WYoafwrhd40rc28bNK2::eWprVjBwNx
call System.Void WYoafwrhd40rc28bNK2::HO9rt9bRol(System.Object,WYoafwrhd40rc28bNK2)
ldc.i4 0
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_883333b7486f4d10b8bf6f4d0fdfcf05
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_fdabef902818413f891db2ebe3357a7d
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 3
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014D: ldloc V_0
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_7d90eb7b0b144f67acd9cdf474b0a67c
brtrue IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld qIHJ0ar5lbIsEVpYgHF qIHJ0ar5lbIsEVpYgHF::EWKrURKxuh
call System.Void qIHJ0ar5lbIsEVpYgHF::HO9rt9bRol(qIHJ0ar5lbIsEVpYgHF)
ldc.i4 5
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_58d3dc4428b641078630ced4a7f8aeab
brtrue IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
Module Name
Ivltcndzfyw.exe
Full Name
Ivltcndzfyw.exe
EntryPoint
System.Void aZZSMjHK9uDeK8svOn.DuMHnrrYr0b0buCsUF::iqXAGVPy4()
Scope Name
Ivltcndzfyw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ivltcndzfyw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aZZSMjHK9uDeK8svOn.DuMHnrrYr0b0buCsUF::iqXAGVPy4()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0192: ldsfld qIHJ0ar5lbIsEVpYgHF qIHJ0ar5lbIsEVpYgHF::EWKrURKxuh
nop <null>
ldsfld D34wdXrZQ1uJpSLgkVe D34wdXrZQ1uJpSLgkVe::awPrpaXmbj
call System.Byte[] D34wdXrZQ1uJpSLgkVe::HO9rt9bRol(D34wdXrZQ1uJpSLgkVe)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_1753d32b1940400d99719debf14a5879
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 1398810587
ldc.i4 1338824378
xor <null>
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_21d7eed98e8948b588e175eebc50f9cb
xor <null>
ldsfld q2cdyQrrJI8oU19RWxJ q2cdyQrrJI8oU19RWxJ::nvorHDlYmE
call System.String q2cdyQrrJI8oU19RWxJ::HO9rt9bRol(System.Int32,q2cdyQrrJI8oU19RWxJ)
ldc.i4 1920191706
ldc.i4 392214455
xor <null>
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_6f6972368e554452a3765bb00d487eb3
xor <null>
ldsfld q2cdyQrrJI8oU19RWxJ q2cdyQrrJI8oU19RWxJ::nvorHDlYmE
call System.String q2cdyQrrJI8oU19RWxJ::HO9rt9bRol(System.Int32,q2cdyQrrJI8oU19RWxJ)
newobj System.Void HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld wXAZNvrAdeDQt4TNDYr wXAZNvrAdeDQt4TNDYr::f72rcTasv5
call HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB wXAZNvrAdeDQt4TNDYr::HO9rt9bRol(System.Object,System.Byte[],wXAZNvrAdeDQt4TNDYr)
ldsfld vjQjTCrNi587SjGyCqc vjQjTCrNi587SjGyCqc::ThkrgHqOVU
call HGOxafybGIUpFYkBY9c.rmgj4hytmayjj3ywvjB vjQjTCrNi587SjGyCqc::HO9rt9bRol(System.Object,vjQjTCrNi587SjGyCqc)
ldsfld WYoafwrhd40rc28bNK2 WYoafwrhd40rc28bNK2::eWprVjBwNx
call System.Void WYoafwrhd40rc28bNK2::HO9rt9bRol(System.Object,WYoafwrhd40rc28bNK2)
ldc.i4 0
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_883333b7486f4d10b8bf6f4d0fdfcf05
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_fdabef902818413f891db2ebe3357a7d
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 3
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014D: ldloc V_0
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_7d90eb7b0b144f67acd9cdf474b0a67c
brtrue IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld qIHJ0ar5lbIsEVpYgHF qIHJ0ar5lbIsEVpYgHF::EWKrURKxuh
call System.Void qIHJ0ar5lbIsEVpYgHF::HO9rt9bRol(qIHJ0ar5lbIsEVpYgHF)
ldc.i4 5
ldsfld <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6} <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_2aac5ca708134fe0b03c7334cdd946ea
ldfld System.Int32 <Module>{5092e66d-8cb2-4dab-862e-116a483d77d6}::m_58d3dc4428b641078630ced4a7f8aeab
brtrue IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
15742024eec468767a0b6bdf96085c20
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uxTIErxRSN3oGhGR8e.JnlTXqQcOJy5VY2MkH
OF9RYKZZ1ZaFAG5JHG.M4S1ZUpqWVHxXPF32r
F2kaMj51aON9RmPbOP.UuNa12UuY9dc6y6v68
mTAd7UyND0ypXjcILy.mGuGMG2HemvpDX6oWC
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙