Malicious
Malicious

21fb6930c2679a056a8cfd79f93f53cd

PE Executable
MD5: 21fb6930c2679a056a8cfd79f93f53cd
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 21fb6930c2679a056a8cfd79f93f53cd
Sha1 d2adac82d0821c8590dd95599abd5bd1e43ff1d8
Sha256 070181f442b486e6bc3192434f99c19bff30441fdc069a2274987d742178c2ec
Sha384 a7beac46d14749fb2ae7944866a9dd7688a40b48727ced313bcaf7f68ce1f8b0561f2ed8828b282d260ca8e3a833f970
Sha512 f19a6adbbcf822b6bf28a9afd6ae5025cdd585d0f708ee006832250f1c0d9bdc83a4f558fa09c17346901aecb61d8fc731cde392d8f6697311a5f439b7c51993
SSDeep 12288:VOBkAAB9XyH8KM/0uQ3cxaIdChRLJtRtYLZHudMa0Y/k9fMgnsbhE:hXk8KMMuzojtRtydHY/k97si
TLSH B305BF6B77824F21C24A2372C1C7490187EA864376ABFB0B718513D61E473EEDE4B697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
21fb6930c2679a056a8cfd79f93f53cd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
rLkoikjLpLd5XLCvdy.l1xnqm1uX41YrPUM1N
mrljgcLCT3ORgdKuQJ.iAY4BliDceMaAHZDhS
euCodtb2lx84nwIXXJ.A47rAE3ZHS811VwDH1
26X1LpmfWHGB2gEBBI.DOSWTXKVTSxkmCrhba
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rwvouxsln.exe
Full Name
Rwvouxsln.exe
EntryPoint
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Scope Name
Rwvouxsln.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rwvouxsln
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_019D: ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
nop <null>
ldsfld NlhupUOjaPsApnLNVrE NlhupUOjaPsApnLNVrE::KmNO10haoP
call System.Byte[] NlhupUOjaPsApnLNVrE::OQtOAWjZJE(NlhupUOjaPsApnLNVrE)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_ff529794a10444949420d2b6aa79f8e6
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 6
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0126: leave IL_01C6
ldc.i4 -1699007622
ldc.i4 1174560312
xor <null>
ldc.i4 -213120655
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_1e2bc080942e4c0d8f28ab730680f524
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
ldc.i4 991149535
ldc.i4 1290226841
add <null>
ldc.i4 -1224287119
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_a30ade184a094199a1e4cc7566fe6047
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
newobj System.Void vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld oGUCD2OMR1cHLden74F oGUCD2OMR1cHLden74F::CSUOfReWDY
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf oGUCD2OMR1cHLden74F::OQtOAWjZJE(System.Object,System.Byte[],oGUCD2OMR1cHLden74F)
ldsfld yfUQ1gOklfACehLgLBG yfUQ1gOklfACehLgLBG::G7aOWTDvcn
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf yfUQ1gOklfACehLgLBG::OQtOAWjZJE(System.Object,yfUQ1gOklfACehLgLBG)
ldsfld yhIH92O4neSffaZe5IF yhIH92O4neSffaZe5IF::r5PO2e0Wy1
call System.Void yhIH92O4neSffaZe5IF::OQtOAWjZJE(System.Object,yhIH92O4neSffaZe5IF)
ldc.i4 1
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_99b3b71a0021404f93156763af8040b4
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 5
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_492ab46b704541db9ddafa5df28be6c8
brtrue IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0159: ldloc V_1
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_e5c67b535d974e0f83f2e9a856c924ed
brfalse IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
call System.Void dYLvQbObTYs9jmc73vI::OQtOAWjZJE(dYLvQbObTYs9jmc73vI)
ldc.i4 2
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_759e781231714a748d55f59f5a6fc8f3
brtrue IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ret <null>
Module Name
Rwvouxsln.exe
Full Name
Rwvouxsln.exe
EntryPoint
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Scope Name
Rwvouxsln.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rwvouxsln
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_019D: ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
nop <null>
ldsfld NlhupUOjaPsApnLNVrE NlhupUOjaPsApnLNVrE::KmNO10haoP
call System.Byte[] NlhupUOjaPsApnLNVrE::OQtOAWjZJE(NlhupUOjaPsApnLNVrE)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_ff529794a10444949420d2b6aa79f8e6
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 6
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0126: leave IL_01C6
ldc.i4 -1699007622
ldc.i4 1174560312
xor <null>
ldc.i4 -213120655
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_1e2bc080942e4c0d8f28ab730680f524
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
ldc.i4 991149535
ldc.i4 1290226841
add <null>
ldc.i4 -1224287119
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_a30ade184a094199a1e4cc7566fe6047
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
newobj System.Void vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld oGUCD2OMR1cHLden74F oGUCD2OMR1cHLden74F::CSUOfReWDY
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf oGUCD2OMR1cHLden74F::OQtOAWjZJE(System.Object,System.Byte[],oGUCD2OMR1cHLden74F)
ldsfld yfUQ1gOklfACehLgLBG yfUQ1gOklfACehLgLBG::G7aOWTDvcn
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf yfUQ1gOklfACehLgLBG::OQtOAWjZJE(System.Object,yfUQ1gOklfACehLgLBG)
ldsfld yhIH92O4neSffaZe5IF yhIH92O4neSffaZe5IF::r5PO2e0Wy1
call System.Void yhIH92O4neSffaZe5IF::OQtOAWjZJE(System.Object,yhIH92O4neSffaZe5IF)
ldc.i4 1
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_99b3b71a0021404f93156763af8040b4
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 5
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_492ab46b704541db9ddafa5df28be6c8
brtrue IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0159: ldloc V_1
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_e5c67b535d974e0f83f2e9a856c924ed
brfalse IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
call System.Void dYLvQbObTYs9jmc73vI::OQtOAWjZJE(dYLvQbObTYs9jmc73vI)
ldc.i4 2
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_759e781231714a748d55f59f5a6fc8f3
brtrue IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ret <null>
21fb6930c2679a056a8cfd79f93f53cd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
rLkoikjLpLd5XLCvdy.l1xnqm1uX41YrPUM1N
mrljgcLCT3ORgdKuQJ.iAY4BliDceMaAHZDhS
euCodtb2lx84nwIXXJ.A47rAE3ZHS811VwDH1
26X1LpmfWHGB2gEBBI.DOSWTXKVTSxkmCrhba
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙