Malicious
Malicious

24453f26fd490c42009a19e91881e1a1

PE Executable
MD5: 24453f26fd490c42009a19e91881e1a1
Size: 581.12 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 24453f26fd490c42009a19e91881e1a1
Sha1 df5cd4004ff8e80b5c55e96024d183e54f9f02f5
Sha256 392bede600c5f3202b72e34b0c84d9aad85bf9e8bfed7811e7043410c09b03eb
Sha384 3288d5b2fcd999fe11093804a47e5b389a1d7fff1fef6e40581dc8fea494e3ce414182444db9705c7bfcb730528d7208
Sha512 754f78e98bff46a672d7ef46fc9673f2b3dd3f27bbfd4f66c2e979809aa8d7356402895060c2b7db0864bd55ed3ab4466ad6c5d5d34f3e331c356a1b7dbcaba7
SSDeep 12288:WC4WemA5XyLR2u6BxGaRANkYE62wzkYV957YeBpYFJ:R4WmsR2u6BxNC9+wNTBpYF
TLSH 91C47D2736924F21C29D1733D1D79400C3EA964336ABEB2B3585239A1D463FFDA0A797
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
24453f26fd490c42009a19e91881e1a1
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PIZQpH2rwfEgSlwNJX.Xbqa7E57t9H6NJsWbF
7yBnTJ4GK9YLDkaKw3.729tGoCuJJDeL8TVjD
4PnkRsgwBUlheXmljX.hygMbCvA2fuLgKGaki
gfRujXUZdCgGVKnGXL.xiI8F0WiMJKvXpYRSI
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qdibjvs.exe
Full Name
Qdibjvs.exe
EntryPoint
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Scope Name
Qdibjvs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qdibjvs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: nop
nop <null>
ldsfld yelcaJ9ohXWwTfaD4vT yelcaJ9ohXWwTfaD4vT::qYs9pypXRj
call System.Byte[] yelcaJ9ohXWwTfaD4vT::ujP9PU4qBE(yelcaJ9ohXWwTfaD4vT)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c32e87848ba34db7a2152e8e370f4a4f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0111,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 547803434
ldc.i4 547803434
ldc.i4 1407571334
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_9ba821264536427a82df865530efe87d
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
ldc.i4 -1922876739
ldc.i4 -1644287384
sub <null>
ldc.i4 -1496956168
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_30309e21a4804f07b21f6797d6ea66f0
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
newobj System.Void jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL::.ctor(System.String,System.String)
newobj System.Void HMCHPsUj9ZeLg0ad0Pn.WqiRjvU7q6bBGBd6uwa::.ctor(jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL)
ldloc.s V_1
ldsfld e6eR8e9ki7DN6kqXGm3 e6eR8e9ki7DN6kqXGm3::ElP9XdS9oB
call System.Void e6eR8e9ki7DN6kqXGm3::ujP9PU4qBE(System.Object,System.Byte[],e6eR8e9ki7DN6kqXGm3)
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_73d5e531af36445db4ea7cc8d7ec3c5f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0111,IL_0096)
leave IL_0188: ret
pop <null>
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_cfae27e92f07498f8b52f524ccc0d101
brfalse IL_0148: switch(IL_0164)
pop <null>
ldc.i4 0
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0144: ldloc V_0
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c788516a0a4b43249be17217866d364e
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld QGBqlW9dNAe9XMDcQGe QGBqlW9dNAe9XMDcQGe::DWN96qZtL2
call System.Void QGBqlW9dNAe9XMDcQGe::ujP9PU4qBE(QGBqlW9dNAe9XMDcQGe)
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_d2abbc468cad4228831fc41bb4ac4355
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
Module Name
Qdibjvs.exe
Full Name
Qdibjvs.exe
EntryPoint
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Scope Name
Qdibjvs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qdibjvs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: nop
nop <null>
ldsfld yelcaJ9ohXWwTfaD4vT yelcaJ9ohXWwTfaD4vT::qYs9pypXRj
call System.Byte[] yelcaJ9ohXWwTfaD4vT::ujP9PU4qBE(yelcaJ9ohXWwTfaD4vT)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c32e87848ba34db7a2152e8e370f4a4f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0111,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 547803434
ldc.i4 547803434
ldc.i4 1407571334
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_9ba821264536427a82df865530efe87d
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
ldc.i4 -1922876739
ldc.i4 -1644287384
sub <null>
ldc.i4 -1496956168
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_30309e21a4804f07b21f6797d6ea66f0
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
newobj System.Void jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL::.ctor(System.String,System.String)
newobj System.Void HMCHPsUj9ZeLg0ad0Pn.WqiRjvU7q6bBGBd6uwa::.ctor(jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL)
ldloc.s V_1
ldsfld e6eR8e9ki7DN6kqXGm3 e6eR8e9ki7DN6kqXGm3::ElP9XdS9oB
call System.Void e6eR8e9ki7DN6kqXGm3::ujP9PU4qBE(System.Object,System.Byte[],e6eR8e9ki7DN6kqXGm3)
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_73d5e531af36445db4ea7cc8d7ec3c5f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0111,IL_0096)
leave IL_0188: ret
pop <null>
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_cfae27e92f07498f8b52f524ccc0d101
brfalse IL_0148: switch(IL_0164)
pop <null>
ldc.i4 0
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0144: ldloc V_0
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c788516a0a4b43249be17217866d364e
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld QGBqlW9dNAe9XMDcQGe QGBqlW9dNAe9XMDcQGe::DWN96qZtL2
call System.Void QGBqlW9dNAe9XMDcQGe::ujP9PU4qBE(QGBqlW9dNAe9XMDcQGe)
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_d2abbc468cad4228831fc41bb4ac4355
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
24453f26fd490c42009a19e91881e1a1
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PIZQpH2rwfEgSlwNJX.Xbqa7E57t9H6NJsWbF
7yBnTJ4GK9YLDkaKw3.729tGoCuJJDeL8TVjD
4PnkRsgwBUlheXmljX.hygMbCvA2fuLgKGaki
gfRujXUZdCgGVKnGXL.xiI8F0WiMJKvXpYRSI
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙