Malicious
Malicious

21fb6930c2679a056a8cfd79f93f53cd

Share on LinkedIn
Print
PE Executable
MD5: 21fb6930c2679a056a8cfd79f93f53cd
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 21fb6930c2679a056a8cfd79f93f53cd
Sha1 d2adac82d0821c8590dd95599abd5bd1e43ff1d8
Sha256 070181f442b486e6bc3192434f99c19bff30441fdc069a2274987d742178c2ec
Sha384 a7beac46d14749fb2ae7944866a9dd7688a40b48727ced313bcaf7f68ce1f8b0561f2ed8828b282d260ca8e3a833f970
Sha512 f19a6adbbcf822b6bf28a9afd6ae5025cdd585d0f708ee006832250f1c0d9bdc83a4f558fa09c17346901aecb61d8fc731cde392d8f6697311a5f439b7c51993
SSDeep 12288:VOBkAAB9XyH8KM/0uQ3cxaIdChRLJtRtYLZHudMa0Y/k9fMgnsbhE:hXk8KMMuzojtRtydHY/k97si
TLSH B305BF6B77824F21C24A2372C1C7490187EA864376ABFB0B718513D61E473EEDE4B697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
21fb6930c2679a056a8cfd79f93f53cd
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
rLkoikjLpLd5XLCvdy.l1xnqm1uX41YrPUM1N
mrljgcLCT3ORgdKuQJ.iAY4BliDceMaAHZDhS
euCodtb2lx84nwIXXJ.A47rAE3ZHS811VwDH1
26X1LpmfWHGB2gEBBI.DOSWTXKVTSxkmCrhba
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rwvouxsln.exe
Full Name
Rwvouxsln.exe
EntryPoint
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Scope Name
Rwvouxsln.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rwvouxsln
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_019D: ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
nop <null>
ldsfld NlhupUOjaPsApnLNVrE NlhupUOjaPsApnLNVrE::KmNO10haoP
call System.Byte[] NlhupUOjaPsApnLNVrE::OQtOAWjZJE(NlhupUOjaPsApnLNVrE)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_ff529794a10444949420d2b6aa79f8e6
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 6
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0126: leave IL_01C6
ldc.i4 -1699007622
ldc.i4 1174560312
xor <null>
ldc.i4 -213120655
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_1e2bc080942e4c0d8f28ab730680f524
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
ldc.i4 991149535
ldc.i4 1290226841
add <null>
ldc.i4 -1224287119
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_a30ade184a094199a1e4cc7566fe6047
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
newobj System.Void vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld oGUCD2OMR1cHLden74F oGUCD2OMR1cHLden74F::CSUOfReWDY
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf oGUCD2OMR1cHLden74F::OQtOAWjZJE(System.Object,System.Byte[],oGUCD2OMR1cHLden74F)
ldsfld yfUQ1gOklfACehLgLBG yfUQ1gOklfACehLgLBG::G7aOWTDvcn
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf yfUQ1gOklfACehLgLBG::OQtOAWjZJE(System.Object,yfUQ1gOklfACehLgLBG)
ldsfld yhIH92O4neSffaZe5IF yhIH92O4neSffaZe5IF::r5PO2e0Wy1
call System.Void yhIH92O4neSffaZe5IF::OQtOAWjZJE(System.Object,yhIH92O4neSffaZe5IF)
ldc.i4 1
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_99b3b71a0021404f93156763af8040b4
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 5
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_492ab46b704541db9ddafa5df28be6c8
brtrue IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0159: ldloc V_1
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_e5c67b535d974e0f83f2e9a856c924ed
brfalse IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
call System.Void dYLvQbObTYs9jmc73vI::OQtOAWjZJE(dYLvQbObTYs9jmc73vI)
ldc.i4 2
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_759e781231714a748d55f59f5a6fc8f3
brtrue IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ret <null>
Module Name
Rwvouxsln.exe
Full Name
Rwvouxsln.exe
EntryPoint
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Scope Name
Rwvouxsln.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rwvouxsln
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void rghZqhXoJFvveTeh6O.ITWL6DO4p4L1PV4D2P::fGjMpdvRe()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_019D: ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
nop <null>
ldsfld NlhupUOjaPsApnLNVrE NlhupUOjaPsApnLNVrE::KmNO10haoP
call System.Byte[] NlhupUOjaPsApnLNVrE::OQtOAWjZJE(NlhupUOjaPsApnLNVrE)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_ff529794a10444949420d2b6aa79f8e6
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 6
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0126: leave IL_01C6
ldc.i4 -1699007622
ldc.i4 1174560312
xor <null>
ldc.i4 -213120655
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_1e2bc080942e4c0d8f28ab730680f524
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
ldc.i4 991149535
ldc.i4 1290226841
add <null>
ldc.i4 -1224287119
xor <null>
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_a30ade184a094199a1e4cc7566fe6047
xor <null>
ldsfld f4KdCAOOXOYUe7P92o6 f4KdCAOOXOYUe7P92o6::d2COX9wf4X
call System.String f4KdCAOOXOYUe7P92o6::OQtOAWjZJE(System.Int32,f4KdCAOOXOYUe7P92o6)
newobj System.Void vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld oGUCD2OMR1cHLden74F oGUCD2OMR1cHLden74F::CSUOfReWDY
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf oGUCD2OMR1cHLden74F::OQtOAWjZJE(System.Object,System.Byte[],oGUCD2OMR1cHLden74F)
ldsfld yfUQ1gOklfACehLgLBG yfUQ1gOklfACehLgLBG::G7aOWTDvcn
call vLtTmXm8HOigOZWcspS.iUPXC7mAfsS1WBcaTpf yfUQ1gOklfACehLgLBG::OQtOAWjZJE(System.Object,yfUQ1gOklfACehLgLBG)
ldsfld yhIH92O4neSffaZe5IF yhIH92O4neSffaZe5IF::r5PO2e0Wy1
call System.Void yhIH92O4neSffaZe5IF::OQtOAWjZJE(System.Object,yhIH92O4neSffaZe5IF)
ldc.i4 1
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_99b3b71a0021404f93156763af8040b4
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 5
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_492ab46b704541db9ddafa5df28be6c8
brtrue IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0159: ldloc V_1
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 0
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_e5c67b535d974e0f83f2e9a856c924ed
brfalse IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ldsfld dYLvQbObTYs9jmc73vI dYLvQbObTYs9jmc73vI::fUMO3IeB9v
call System.Void dYLvQbObTYs9jmc73vI::OQtOAWjZJE(dYLvQbObTYs9jmc73vI)
ldc.i4 2
ldsfld <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766} <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_3323efb62d71454a81a0ca1ecbb04bbd
ldfld System.Int32 <Module>{6a33c267-ace3-4fe6-87c2-5194fa42b766}::m_759e781231714a748d55f59f5a6fc8f3
brtrue IL_0014: switch(IL_01C6,IL_0038,IL_019D)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01C6,IL_0038,IL_019D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙