Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.32 MB · 1,320,960 B
First seen
2026-07-14 09:02 · 3 months ago
Last seen
2026-07-14 09:02 · 3 months ago
Last analysis
2026-07-14 09:02 · 3 months ago
Hashes
MD5 183573ffe3b0c5f9188c5fab6b80ebec Sha1 b9308e6c91b64f4695a5418276a25f35e6eb18ae Sha256 bc6d86cef1b7404823c1d830387b2c9b1289c453620482fc1749dd5d2ade3897 Sha384 c56dc5c75c64a409cbe78bbccc7fd9573f86c9fbdb8b09bdce4d7791aeba35b8fdc9bacf1dd387d341ff97faddb9002d Sha512 426747a3bbf7a8107a59a9840623f2a1e93e71b327fe3753a87fa854ada2fc3c63295303c8441cf159a4e4b473824123c8ba905f55118f393ce4c125afa3b2d2 SSDeep 24576:4XS2UxAPqGcv/+Duyx4QIPOr+e4ggVqAXOI6+wF2s0O8BD48rWHFDW+1RUr:w+qPRcvEryggdXOI6XL0O8BD48rWHFDC TLSH 9955F10822D4D688E8BE97364950D83987F1BC5B9616DB2D7ACD3CEF3B76B424406723
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 72 files
EXE183573ffe3b0c5f9188c5fab6b80ebec.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
BINID:0
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
IMGID:0
IMGID:0-preview.png
BINID:0037
BINID:0
BINID:0038
BINID:0
BINID:0039
BINID:0
BINID:003A
BINID:0
BINID:003B
BINID:0
BINID:003C
BINID:0
BINID:003D
BINID:0
BINID:003E
BINID:0
BINID:003F
BINID:0
BINID:0040
BINID:0
BINID:0041
BINID:0
BINID:0042
BINID:0
BINID:0043
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TIFFGenitalk.klaoxao.tiff
BINeWa6N0yrdZ.Resources.resources
BINd62026b421e2a9.Resources.resources
BIN525d34560
DATA[NBF]root.Data
BIN525d34561
DATA[NBF]root.Data
BIN525d345610
DATA[NBF]root.Data
BIN525d345611
DATA[NBF]root.Data
BIN525d345612
DATA[NBF]root.Data
BIN525d345613
DATA[NBF]root.Data
BIN525d345614
DATA[NBF]root.Data
BIN525d345615
DATA[NBF]root.Data
BIN525d345616
DATA[NBF]root.Data
BIN525d345617
DATA[NBF]root.Data
BIN525d345618
DATA[NBF]root.Data
BIN525d345619
DATA[NBF]root.Data
BIN525d34562
DATA[NBF]root.Data
BIN525d34563
DATA[NBF]root.Data
BIN525d34564
DATA[NBF]root.Data
BIN525d34565
DATA[NBF]root.Data
BIN525d34566
DATA[NBF]root.Data
BIN525d34567
DATA[NBF]root.Data
BIN525d34568
DATA[NBF]root.Data
BIN525d34569
DATA[NBF]root.Data
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINObjectRequester.ScopeObject
BINScheduledObject.ObjectParser
BINDecryptorCompressor.ControllableObject
BINAuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
eWa6N0yrdZ
Full Name
eWa6N0yrdZ
EntryPoint
System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::4Rzepd2M9()
Scope Name
eWa6N0yrdZ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eWa6N0yrdZ
Assembly Version
28.26.14.54
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::4Rzepd2M9()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean eWa6N0yrdZ.7NoaykJ1C3cgw::Xf8i0tdBN4k()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::Hb8a1EtiTwj4n()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::re3Pa2SizXd8j9(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
eWa6N0yrdZ
Full Name
eWa6N0yrdZ
EntryPoint
System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::4Rzepd2M9()
Scope Name
eWa6N0yrdZ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
eWa6N0yrdZ
Assembly Version
28.26.14.54
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::4Rzepd2M9()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean eWa6N0yrdZ.7NoaykJ1C3cgw::Xf8i0tdBN4k()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::Hb8a1EtiTwj4n()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::re3Pa2SizXd8j9(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void eWa6N0yrdZ.7NoaykJ1C3cgw::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
2 malicious · 72 files
EXE183573ffe3b0c5f9188c5fab6b80ebec.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙