Malicious
Malicious

16ebbbaafb70c2bf679ff8c37c283fac

Share on LinkedIn
Print
PE Executable
MD5: 16ebbbaafb70c2bf679ff8c37c283fac
Size: 433.66 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 423.5 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
cab8bacba10160205866f91c19b5404b3bd6d4de2154621bc6a3a45f842a51f4
MD5
16ebbbaafb70c2bf679ff8c37c283fac
Verdict
Malicious
File type
PE Executable · 423.5 KB

Cite this report: https://app.malva.re/sha256/cab8bacba10160205866f91c19b5404b3bd6d4de2154621bc6a3a45f842a51f4

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
433.66 KB · 433,664 B
Hashes
MD5 16ebbbaafb70c2bf679ff8c37c283fac Sha1 1384926390b93fa8c65ad7c7da76355e9c06f90d Sha256 cab8bacba10160205866f91c19b5404b3bd6d4de2154621bc6a3a45f842a51f4 Sha384 0372d13e08d46d00335a680ffa3b1ada27afed5df77df60e31c3b108a79b273ee3a507d800d964e13253466b885590e0 Sha512 c60a55cf765fbdda6eb3cc81c6a093e5b94dccc85f2ccccaa53660c562b205cd9755c8256b81f1025a70617a3d4d9ac349dcfe5ff0fcc35d2a11995370683dbe SSDeep 6144:WmroC1xhe2iFPxpZ0UNd/oviNLM5WnZaY/UrTetV:rDHdiHKvpkoY/q67 TLSH 69945B5776620F54E1845737D4CB090083EA6682B767E30FB28423961D427FFEE4B6AB
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXE16ebbbaafb70c2bf679ff8c37c283fac
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Ijdhacasrm.exe
Full Name
Ijdhacasrm.exe
EntryPoint
System.Void pVCl2AwGP9km1NiBbq.NqhNRGReVV2LTVNH5s::jw9C7kNYa()
Scope Name
Ijdhacasrm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ijdhacasrm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pVCl2AwGP9km1NiBbq.NqhNRGReVV2LTVNH5s::jw9C7kNYa()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: nop
nop <null>
newobj System.Void djG5hRk8AW7pF4qq4l.nklioecTPnIbc2KE9r::.ctor()
ldsfld YCCqM2suIXZJc1SHZeZ YCCqM2suIXZJc1SHZeZ::MeIsZyXu7T
call System.Void YCCqM2suIXZJc1SHZeZ::iuks4qpiXd(System.Object,YCCqM2suIXZJc1SHZeZ)
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_658e69285c8c4ae08f23c4480181468e
brtrue IL_0079: switch(IL_0095)
pop <null>
ldc.i4 2
br IL_0079: switch(IL_0095)
br IL_0075: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0075: ldloc V_1
br IL_0095: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_9934b3bac3b748d7875e0d41dd823fa8
brtrue IL_00CC: switch(IL_00E8)
pop <null>
ldc.i4 3
br IL_00CC: switch(IL_00E8)
br IL_00C8: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C8: ldloc V_2
br IL_00E8: leave IL_0135
leave IL_0135: ret
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_ef9aba517ddc4388bfd6ed8c62a39786
brfalse IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ldsfld cbec9CsNdTGyoGkOcne cbec9CsNdTGyoGkOcne::wVSsXlCFjH
call System.Void cbec9CsNdTGyoGkOcne::iuks4qpiXd(cbec9CsNdTGyoGkOcne)
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_bb77e8dec48d40e584ed8af6fee248b1
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ret <null>
Module Name
Ijdhacasrm.exe
Full Name
Ijdhacasrm.exe
EntryPoint
System.Void pVCl2AwGP9km1NiBbq.NqhNRGReVV2LTVNH5s::jw9C7kNYa()
Scope Name
Ijdhacasrm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ijdhacasrm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pVCl2AwGP9km1NiBbq.NqhNRGReVV2LTVNH5s::jw9C7kNYa()
Main IL Instruction Count
66
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: nop
nop <null>
newobj System.Void djG5hRk8AW7pF4qq4l.nklioecTPnIbc2KE9r::.ctor()
ldsfld YCCqM2suIXZJc1SHZeZ YCCqM2suIXZJc1SHZeZ::MeIsZyXu7T
call System.Void YCCqM2suIXZJc1SHZeZ::iuks4qpiXd(System.Object,YCCqM2suIXZJc1SHZeZ)
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_658e69285c8c4ae08f23c4480181468e
brtrue IL_0079: switch(IL_0095)
pop <null>
ldc.i4 2
br IL_0079: switch(IL_0095)
br IL_0075: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0075: ldloc V_1
br IL_0095: leave IL_0135
leave IL_0135: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_9934b3bac3b748d7875e0d41dd823fa8
brtrue IL_00CC: switch(IL_00E8)
pop <null>
ldc.i4 3
br IL_00CC: switch(IL_00E8)
br IL_00C8: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C8: ldloc V_2
br IL_00E8: leave IL_0135
leave IL_0135: ret
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_ef9aba517ddc4388bfd6ed8c62a39786
brfalse IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ldsfld cbec9CsNdTGyoGkOcne cbec9CsNdTGyoGkOcne::wVSsXlCFjH
call System.Void cbec9CsNdTGyoGkOcne::iuks4qpiXd(cbec9CsNdTGyoGkOcne)
ldc.i4 0
ldsfld <Module>{f7961958-946c-4871-99e8-80aa9a586c1d} <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_3ab8243047744cd48910ffecc8fd30b9
ldfld System.Int32 <Module>{f7961958-946c-4871-99e8-80aa9a586c1d}::m_bb77e8dec48d40e584ed8af6fee248b1
brtrue IL_0014: switch(IL_0038,IL_010C,IL_0135)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_010C,IL_0135)
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙