19978ce5638fe0842360cff3413dbade

PE Executable

MD5: 19978ce5638fe0842360cff3413dbade

Size: 16.13 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	19978ce5638fe0842360cff3413dbade
Sha1	4c7c2dcd88d1394a56da56bb7f05a68e8b08810b
Sha256	4c8f57d4b75151695a0f6bc485c41a459368df495b44ea44216d482a033f091f
Sha384	c5a4d6f342d49a5b826571001afd2ec1e8ea6cbdd97f387535d7d4ef90adfde8dd3ff539f9ebc99387f9ea011ecb303f
Sha512	a6efe28036ad6e75c38ac81a3a281479d6b9f42a8ab6a1707558b7dc606cee6de4105f5ded172d9a8ce45a8ae6106f065b55f1c29ba8512089eb746342abaeeb
SSDeep	393216:lmW4cAY+y7BOIBSYLCtnq61FLBAiEVV/o:ld4U+yFOIc5tZ/LmJ6
TLSH	9AF633E8F19C8CBCD90B45318FB272EDD2E20447CB96722A55E945C471B36F2F2AC259

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon

STICH beta

No STICH Path has been generated for this analysis yet.

8 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 8

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Pawly.exe
Full Name	Pawly.exe
EntryPoint	System.Void A.A::A()
Scope Name	Pawly.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Pawly
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	0
Main Method	System.Void A.A::A()
Main IL Instruction Count	164
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::A() callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.0 <null> ldloc.0 <null> brtrue.s IL_0033: call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create() call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::a() newobj System.Void System.IO.IOException::.ctor(System.String) throw <null> call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create() stloc.2 <null> ldloc.2 <null> ldloc.0 <null> callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.IO.Stream) call System.String System.BitConverter::ToString(System.Byte[]) call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::B() call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::b() callvirt System.String System.String::Replace(System.String,System.String) ldc.i4.0 <null> ldc.i4.s 20 callvirt System.String System.String::Substring(System.Int32,System.Int32) stloc.1 <null> leave.s IL_0069: ldloc.0 ldloc.2 <null> brfalse.s IL_0068: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.0 <null> ldc.i4.0 <null> conv.i8 <null> callvirt System.Void System.IO.Stream::set_Position(System.Int64) ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::C() call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::c() ldloc.1 <null> call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stsfld System.String A.A::A ldsfld System.String A.A::A call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> ldc.i4.0 <null> newobj System.Void System.IO.Compression.ZipArchive::.ctor(System.IO.Stream,System.IO.Compression.ZipArchiveMode) stloc.3 <null> ldloc.3 <null> callvirt System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry> System.IO.Compression.ZipArchive::get_Entries() callvirt System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry> System.Collections.ObjectModel.ReadOnlyCollection`1<System.IO.Compression.ZipArchiveEntry>::GetEnumerator() stloc.s V_10 br IL_01A2: ldloc.s V_10 ldloc.s V_10 callvirt System.IO.Compression.ZipArchiveEntry System.Collections.Generic.IEnumerator`1<System.IO.Compression.ZipArchiveEntry>::get_Current() stloc.s V_4 ldloc.s V_4 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_Name() call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue IL_01A2: ldloc.s V_10 ldsfld System.String A.A::A ldloc.s V_4 callvirt System.String System.IO.Compression.ZipArchiveEntry::get_FullName() call System.String System.IO.Path::Combine(System.String,System.String) call System.String System.IO.Path::GetFullPath(System.String) stloc.s V_5 ldloc.s V_5 ldsfld System.String A.A::A ldsfld System.Char System.IO.Path::DirectorySeparatorChar box System.Char call System.String System.String::Concat(System.Object,System.Object) ldc.i4.5 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brtrue.s IL_0112: ldloc.s V_5 call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::D() newobj System.Void System.IO.IOException::.ctor(System.String) throw <null> ldloc.s V_5 call System.String System.IO.Path::GetDirectoryName(System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.s V_5 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0199: ldloc.s V_4 call System.Security.Cryptography.SHA256 System.Security.Cryptography.SHA256::Create() stloc.s V_6 ldloc.s V_4 callvirt System.IO.Stream System.IO.Compression.ZipArchiveEntry::Open() stloc.s V_7 ldloc.s V_5 call System.IO.FileStream System.IO.File::OpenRead(System.String) stloc.s V_8 ldloc.s V_6 ldloc.s V_7 callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.IO.Stream) call System.String System.BitConverter::ToString(System.Byte[]) ldloc.s V_6 ldloc.s V_8 callvirt System.Byte[] System.Security.Cryptography.HashAlgorithm::ComputeHash(System.IO.Stream) call System.String System.BitConverter::ToString(System.Byte[]) call System.Boolean System.String::op_Inequality(System.String,System.String) brfalse.s IL_016F: leave.s IL_017D call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::d() newobj System.Void System.IO.IOException::.ctor(System.String) throw <null> leave.s IL_017D: leave.s IL_018B ldloc.s V_8 brfalse.s IL_017C: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_018B: leave.s IL_01A2 ldloc.s V_7 brfalse.s IL_018A: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01A2: ldloc.s V_10 ldloc.s V_6 brfalse.s IL_0198: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 ldloc.s V_5 call System.Void System.IO.Compression.ZipFileExtensions::ExtractToFile(System.IO.Compression.ZipArchiveEntry,System.String) ldloc.s V_10 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() brtrue IL_00B7: ldloc.s V_10 leave.s IL_01BC: leave.s IL_01C8 ldloc.s V_10 brfalse.s IL_01BB: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01C8: leave.s IL_01D4 ldloc.3 <null> brfalse.s IL_01C7: endfinally ldloc.3 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_01D4: newobj System.Void A.a::.ctor() ldloc.0 <null> brfalse.s IL_01D3: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> newobj System.Void A.a::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) leave.s IL_01F9: ret stloc.s V_9 ldloc.s V_9 callvirt System.String System.Exception::get_Message() call System.String <PrivateImplementationDetails>{77ADA0F1-EEB6-440F-A47E-F4CD87F2F92C}.9D792F61-9F57-4AB8-AC3F-122E98B26B1D::C() ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_01F9: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.