Malicious
Malicious

15d1b26149fde69fc4203df9dfb6f220

Share on LinkedIn
Print
PE Executable
MD5: 15d1b26149fde69fc4203df9dfb6f220
Size: 30.72 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 15d1b26149fde69fc4203df9dfb6f220
Sha1 bf2b4974db62c18a5c83ce2f86ddbf1d89b2a030
Sha256 622ad8a0eb9290c6c1fb7924f6019e18b34fee8b7583d756f1c8750ed6e793e8
Sha384 86acb72ecba368c0386c5be5636ca3d21be087fa1abefa49fb2ee0ce85e289f9475be19ace3fc35e3480acd25653104c
Sha512 c590e97a9864a4c2bb111fc118159f04728c7d940bde1fd46355622f1bab0aa9e304fede01bd0c3012a992e11372af797fe178f60c5733225531dd44d9c02a36
SSDeep 768:J225M5U7Em4veab83XldBboRpYkQNg4JptE:J22V7Etv9eXZogkQO4Jpm
TLSH 71D2D11521F90616CA774BFE39E741B113FA7948AC77CD2E58788C1B6A093AF4C017B8
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
15d1b26149fde69fc4203df9dfb6f220
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
a.zip
Malicious
Payload.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
[Content_Types].xml
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>arc:zip>pe:exe>pe:rsrc>bin
Shape pe:exe>arc:zip>pe:exe>pe:rsrc>bin
malicious 5 nodes
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Thuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] dllhuhuhuhu
cnc_host [H] 2.56huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
Anti_CH Fhuhuhuhu
is_startup_folder [IsF] Thuhuhuhu
USB_SP Fhuhuhuhu
is_user_reg [Isu] Thuhuhuhu
cnc_port [P] 9huhuhuhu
reg_key [RG] 4e555ehuhuhuhuhuhuhuhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Vihuhuhuhu
version [VR] <- NjRhuhuhuhuhuhuhuhuhuhuhu
splitter [Y] Y262huhuhuhu
MSGE Dihuhuhuhu
MSGT Thhuhuhuhu
MSGB Sorry,huhuhuhuhuhuhuhuhuhuhu
MSGSYM vbChuhuhuhu
OBITO Enhuhuhuhu
TSKE Enhuhuhuhu
TSK Wirehuhuhuhuhuhuhu
KAKASHI Dihuhuhuhu
AKATSUKI Dihuhuhuhu
CLEANSWEEP Dihuhuhuhu
PASTEE Dihuhuhuhu
PASTEBIN https:huhuhuhuhuhuhuhuhuhuhu
CLIP nhuhuhuhu
UAC Enhuhuhuhu
nowifi ohuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Payload.exe
Full Name
Payload.exe
EntryPoint
System.Void R.P::Main(System.String[])
Scope Name
Payload.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Payload
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void R.P::Main(System.String[])
Main IL Instruction Count
69
Main IL 
ldtoken R.P
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr a.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.3 <null>
ldc.i4.1 <null>
call System.IO.Packaging.Package System.IO.Packaging.Package::Open(System.IO.Stream,System.IO.FileMode,System.IO.FileAccess)
stloc.1 <null>
ldloc.1 <null>
ldstr /Payload.exe
call System.Reflection.Assembly R.P::L(System.IO.Packaging.Package,System.String)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldc.i4.0 <null>
newarr System.Object
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_004E: leave.s IL_005A
ldloc.1 <null>
brfalse.s IL_004D: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_005A: leave.s IL_00A9
ldloc.0 <null>
brfalse.s IL_0059: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00A9: ret
stloc.3 <null>
ldc.i4.5 <null>
newarr System.String
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldloc.3 <null>
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
stelem.ref <null>
ldloc.s V_4
ldc.i4.1 <null>
call System.String System.Environment::get_NewLine()
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
ldloc.s V_4
ldc.i4.3 <null>
call System.String System.Environment::get_NewLine()
stelem.ref <null>
ldloc.s V_4
ldc.i4.4 <null>
ldloc.3 <null>
callvirt System.String System.Exception::get_StackTrace()
stelem.ref <null>
ldloc.s V_4
call System.String System.String::Concat(System.String[])
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
leave.s IL_00A9: ret
ret <null>
Module Name
Payload.exe
Full Name
Payload.exe
EntryPoint
System.Void R.P::Main(System.String[])
Scope Name
Payload.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Payload
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
3
Main Method
System.Void R.P::Main(System.String[])
Main IL Instruction Count
69
Main IL 
ldtoken R.P
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
ldstr a.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.3 <null>
ldc.i4.1 <null>
call System.IO.Packaging.Package System.IO.Packaging.Package::Open(System.IO.Stream,System.IO.FileMode,System.IO.FileAccess)
stloc.1 <null>
ldloc.1 <null>
ldstr /Payload.exe
call System.Reflection.Assembly R.P::L(System.IO.Packaging.Package,System.String)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldc.i4.0 <null>
newarr System.Object
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_004E: leave.s IL_005A
ldloc.1 <null>
brfalse.s IL_004D: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_005A: leave.s IL_00A9
ldloc.0 <null>
brfalse.s IL_0059: endfinally
ldloc.0 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00A9: ret
stloc.3 <null>
ldc.i4.5 <null>
newarr System.String
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
ldloc.3 <null>
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
stelem.ref <null>
ldloc.s V_4
ldc.i4.1 <null>
call System.String System.Environment::get_NewLine()
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
ldloc.s V_4
ldc.i4.3 <null>
call System.String System.Environment::get_NewLine()
stelem.ref <null>
ldloc.s V_4
ldc.i4.4 <null>
ldloc.3 <null>
callvirt System.String System.Exception::get_StackTrace()
stelem.ref <null>
ldloc.s V_4
call System.String System.String::Concat(System.String[])
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
leave.s IL_00A9: ret
ret <null>
CnC CNCmalicious
2.56huhuhuhu
Port PORTmalicious
9huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙