Malicious
Malicious

1dd37f68b68f17c96f3bf26d859a7047

Share on LinkedIn
Print
PE Executable
MD5: 1dd37f68b68f17c96f3bf26d859a7047
Size: 744.96 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
744.96 KB · 744,960 B
First seen
2026-10-14 08:30 · 11 days ago
Last seen
2026-10-14 08:30 · 11 days ago
Last analysis
2026-10-14 08:30 · 11 days ago
Hashes
MD5 1dd37f68b68f17c96f3bf26d859a7047 Sha1 ea81757856c1e12d258c295dfbd407e913cd1d6a Sha256 14b357c53532689c03bfe68651c9678e8ddcfb833c03366f637aca2a354c7ca2 Sha384 9de769e1a62ffb02c8bc8d794de13fc9c145b78dc1fe03a23ff9502f3d7d8754bea04779306ed943fb2fdb71b95de97a Sha512 1194762642f68c16a0f03624b6e797629764def572bc571ebf3e74e2b5b86674781ee01e10852586af6b361c7c0582575effe520c9c71a2382e7c0099c696c34 SSDeep 12288:4dI9cQYlxuAU8gTP3gdYZHGg1P1ZVMXl0PzfAHVx6WtHox/mDKKmJ08v9:G/U8gTgKZmaVMXlUDAtHodMYp TLSH 15F4CE00661ACD52D5EA42B1C8D1D5FF42B06E8BE552F28769C53EAF3A32795F7802C3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 19 files
EXE1dd37f68b68f17c96f3bf26d859a7047
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
iAoT.exe
Full Name
iAoT.exe
EntryPoint
System.Void U2.Q1::kH()
Scope Name
iAoT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
iAoT
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void U2.Q1::kH()
Main IL Instruction Count
43
Main IL 
br IL_0083: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_008E: newobj System.Void xXx.jXj::.ctor()
nop <null>
call System.Void U2.Q1::zr()
br IL_002C: nop
call System.Void ydJ.nd6::K3s()
br IL_0017: nop
nop <null>
newobj System.Void DU9.CU7::.ctor()
stsfld DU9.CU7 U2.Q1::Ws
br IL_005A: newobj System.Void fXQ.mXo::.ctor()
newobj System.Void HtV.ttu::.ctor()
stsfld HtV.ttu U2.Q1::ak
br IL_004B: newobj System.Void zv8.Qvx::.ctor()
newobj System.Void zv8.Qvx::.ctor()
stsfld zv8.Qvx U2.Q1::cT
br IL_00AB: ldsfld zv8.Qvx U2.Q1::cT
newobj System.Void fXQ.mXo::.ctor()
stsfld fXQ.mXo U2.Q1::gn
ldc.i4 0
ldsfld <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce} <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce}::m_970226d09e7d492f882c50ec612562d3
ldfld System.Int32 <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce}::m_dc3c9885fdc245e4af17c1d1bab0e4b3
brtrue IL_0009: switch(IL_008E)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_008E)
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_009F: nop
newobj System.Void xXx.jXj::.ctor()
stsfld xXx.jXj U2.Q1::UA
br IL_003C: newobj System.Void HtV.ttu::.ctor()
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0022: call System.Void ydJ.nd6::K3s()
ldsfld zv8.Qvx U2.Q1::cT
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_009D: nop
Module Name
iAoT.exe
Full Name
iAoT.exe
EntryPoint
System.Void U2.Q1::kH()
Scope Name
iAoT.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
iAoT
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void U2.Q1::kH()
Main IL Instruction Count
43
Main IL 
br IL_0083: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_008E: newobj System.Void xXx.jXj::.ctor()
nop <null>
call System.Void U2.Q1::zr()
br IL_002C: nop
call System.Void ydJ.nd6::K3s()
br IL_0017: nop
nop <null>
newobj System.Void DU9.CU7::.ctor()
stsfld DU9.CU7 U2.Q1::Ws
br IL_005A: newobj System.Void fXQ.mXo::.ctor()
newobj System.Void HtV.ttu::.ctor()
stsfld HtV.ttu U2.Q1::ak
br IL_004B: newobj System.Void zv8.Qvx::.ctor()
newobj System.Void zv8.Qvx::.ctor()
stsfld zv8.Qvx U2.Q1::cT
br IL_00AB: ldsfld zv8.Qvx U2.Q1::cT
newobj System.Void fXQ.mXo::.ctor()
stsfld fXQ.mXo U2.Q1::gn
ldc.i4 0
ldsfld <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce} <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce}::m_970226d09e7d492f882c50ec612562d3
ldfld System.Int32 <Module>{43cf5b59-ccad-4453-8643-3aca3f3cb9ce}::m_dc3c9885fdc245e4af17c1d1bab0e4b3
brtrue IL_0009: switch(IL_008E)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_008E)
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_009F: nop
newobj System.Void xXx.jXj::.ctor()
stsfld xXx.jXj U2.Q1::UA
br IL_003C: newobj System.Void HtV.ttu::.ctor()
nop <null>
ret <null>
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0022: call System.Void ydJ.nd6::K3s()
ldsfld zv8.Qvx U2.Q1::cT
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_009D: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙