Malicious
Malicious

24453f26fd490c42009a19e91881e1a1

Share on LinkedIn
Print
PE Executable
MD5: 24453f26fd490c42009a19e91881e1a1
Size: 581.12 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 24453f26fd490c42009a19e91881e1a1
Sha1 df5cd4004ff8e80b5c55e96024d183e54f9f02f5
Sha256 392bede600c5f3202b72e34b0c84d9aad85bf9e8bfed7811e7043410c09b03eb
Sha384 3288d5b2fcd999fe11093804a47e5b389a1d7fff1fef6e40581dc8fea494e3ce414182444db9705c7bfcb730528d7208
Sha512 754f78e98bff46a672d7ef46fc9673f2b3dd3f27bbfd4f66c2e979809aa8d7356402895060c2b7db0864bd55ed3ab4466ad6c5d5d34f3e331c356a1b7dbcaba7
SSDeep 12288:WC4WemA5XyLR2u6BxGaRANkYE62wzkYV957YeBpYFJ:R4WmsR2u6BxNC9+wNTBpYF
TLSH 91C47D2736924F21C29D1733D1D79400C3EA964336ABEB2B3585239A1D463FFDA0A797
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
24453f26fd490c42009a19e91881e1a1
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
PIZQpH2rwfEgSlwNJX.Xbqa7E57t9H6NJsWbF
7yBnTJ4GK9YLDkaKw3.729tGoCuJJDeL8TVjD
4PnkRsgwBUlheXmljX.hygMbCvA2fuLgKGaki
gfRujXUZdCgGVKnGXL.xiI8F0WiMJKvXpYRSI
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qdibjvs.exe
Full Name
Qdibjvs.exe
EntryPoint
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Scope Name
Qdibjvs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qdibjvs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: nop
nop <null>
ldsfld yelcaJ9ohXWwTfaD4vT yelcaJ9ohXWwTfaD4vT::qYs9pypXRj
call System.Byte[] yelcaJ9ohXWwTfaD4vT::ujP9PU4qBE(yelcaJ9ohXWwTfaD4vT)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c32e87848ba34db7a2152e8e370f4a4f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0111,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 547803434
ldc.i4 547803434
ldc.i4 1407571334
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_9ba821264536427a82df865530efe87d
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
ldc.i4 -1922876739
ldc.i4 -1644287384
sub <null>
ldc.i4 -1496956168
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_30309e21a4804f07b21f6797d6ea66f0
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
newobj System.Void jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL::.ctor(System.String,System.String)
newobj System.Void HMCHPsUj9ZeLg0ad0Pn.WqiRjvU7q6bBGBd6uwa::.ctor(jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL)
ldloc.s V_1
ldsfld e6eR8e9ki7DN6kqXGm3 e6eR8e9ki7DN6kqXGm3::ElP9XdS9oB
call System.Void e6eR8e9ki7DN6kqXGm3::ujP9PU4qBE(System.Object,System.Byte[],e6eR8e9ki7DN6kqXGm3)
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_73d5e531af36445db4ea7cc8d7ec3c5f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0111,IL_0096)
leave IL_0188: ret
pop <null>
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_cfae27e92f07498f8b52f524ccc0d101
brfalse IL_0148: switch(IL_0164)
pop <null>
ldc.i4 0
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0144: ldloc V_0
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c788516a0a4b43249be17217866d364e
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld QGBqlW9dNAe9XMDcQGe QGBqlW9dNAe9XMDcQGe::DWN96qZtL2
call System.Void QGBqlW9dNAe9XMDcQGe::ujP9PU4qBE(QGBqlW9dNAe9XMDcQGe)
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_d2abbc468cad4228831fc41bb4ac4355
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
Module Name
Qdibjvs.exe
Full Name
Qdibjvs.exe
EntryPoint
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Scope Name
Qdibjvs.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qdibjvs
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EX6efitvJuYQs1yJX0.uHbPlo9HOYFqDBrZXv::O7BTXDuZK()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: nop
nop <null>
ldsfld yelcaJ9ohXWwTfaD4vT yelcaJ9ohXWwTfaD4vT::qYs9pypXRj
call System.Byte[] yelcaJ9ohXWwTfaD4vT::ujP9PU4qBE(yelcaJ9ohXWwTfaD4vT)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c32e87848ba34db7a2152e8e370f4a4f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0111,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 547803434
ldc.i4 547803434
ldc.i4 1407571334
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_9ba821264536427a82df865530efe87d
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
ldc.i4 -1922876739
ldc.i4 -1644287384
sub <null>
ldc.i4 -1496956168
xor <null>
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_30309e21a4804f07b21f6797d6ea66f0
xor <null>
ldsfld BcSwdt93KtrBcyYk25x BcSwdt93KtrBcyYk25x::bGu91h9QF2
call System.String BcSwdt93KtrBcyYk25x::ujP9PU4qBE(System.Int32,BcSwdt93KtrBcyYk25x)
newobj System.Void jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL::.ctor(System.String,System.String)
newobj System.Void HMCHPsUj9ZeLg0ad0Pn.WqiRjvU7q6bBGBd6uwa::.ctor(jn2xlP0WE8TuA038J2.gbNIk4VZuGa1faUPnL)
ldloc.s V_1
ldsfld e6eR8e9ki7DN6kqXGm3 e6eR8e9ki7DN6kqXGm3::ElP9XdS9oB
call System.Void e6eR8e9ki7DN6kqXGm3::ujP9PU4qBE(System.Object,System.Byte[],e6eR8e9ki7DN6kqXGm3)
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_73d5e531af36445db4ea7cc8d7ec3c5f
brtrue IL_0076: switch(IL_0111,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0111,IL_0096)
leave IL_0188: ret
pop <null>
ldc.i4 4
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_cfae27e92f07498f8b52f524ccc0d101
brfalse IL_0148: switch(IL_0164)
pop <null>
ldc.i4 0
br IL_0148: switch(IL_0164)
br IL_0144: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0144: ldloc V_0
br IL_0164: leave IL_0188
leave IL_0188: ret
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_c788516a0a4b43249be17217866d364e
brtrue IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
ret <null>
ldsfld QGBqlW9dNAe9XMDcQGe QGBqlW9dNAe9XMDcQGe::DWN96qZtL2
call System.Void QGBqlW9dNAe9XMDcQGe::ujP9PU4qBE(QGBqlW9dNAe9XMDcQGe)
ldc.i4 3
ldsfld <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e} <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_e23674b5d9134c79a06e4dc88e2ca398
ldfld System.Int32 <Module>{d8c1c6fe-a7a5-4f5d-a063-1bc1299c0e4e}::m_d2abbc468cad4228831fc41bb4ac4355
brfalse IL_0014: switch(IL_0038,IL_0189,IL_0188)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0189,IL_0188)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙