25e1a98bf6b4ac5596ee8c805f80aea0

PE Executable

MD5: 25e1a98bf6b4ac5596ee8c805f80aea0

Size: 86.35 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	25e1a98bf6b4ac5596ee8c805f80aea0
Sha1	2dd5b7bee66dcd5090b0c2a8f8765dd9f886495b
Sha256	255c08bad1b9fb0092be6870923e7918cdd11b07fde4657875df8363af9b8843
Sha384	ce2e387472e20b0ad17f62007a0333c655361ef202f4470ce0cf43e7d3231217319f9bfb2fcd2ec4e07960bda9dd3467
Sha512	5a1471962fa2b101542b227e5a8fc94379d2a52af4bf1ebf17e283ed34fd2b1809dd9d048e8a39afed2c1a3ef6fc3f997f1411086d227ff6ece9666236bcd09b
SSDeep	1536:r0zrrtiJbi2Xj5XqnYFx+tqOW/AwSlWbYTjipvF2a:r0EB+IOWY2bYvQd2a
TLSH	A883F802F7879762D56C017500DB21A013F1AFDB5E73D51B3D88339DAA337929E89B8A

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_997cd534.bin (30030 bytes)
Module Name	Nuclear Explosion.exe
Full Name	Nuclear Explosion.exe
EntryPoint	System.Void Nuclear_Explosion.Atomic::Main()
Scope Name	Nuclear Explosion.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Nuclear Explosion
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	42
Main Method	System.Void Nuclear_Explosion.Atomic::Main()
Main IL Instruction Count	91
Main IL	br IL_0007: nop pop <null> ldc.i4.0 <null> nop <null> nop <null> nop <null> ldc.i4 206 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.Environment::GetEnvironmentVariable(System.String) ldc.i4 222 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) stloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() ldloc.0 <null> ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> cgt.un <null> stloc.1 <null> ldloc.1 <null> brfalse IL_0068: nop call System.String System.IO.Path::GetTempPath() ldc.i4 318 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.Windows.Forms.Application::get_ExecutablePath() call System.Void System.IO.File::WriteAllText(System.String,System.String) nop <null> nop <null> nop <null> ldloc.0 <null> ldnull <null> ldsfld System.String Nuclear_Explosion.Atomic::App call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldc.i4.0 <null> call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean) pop <null> leave IL_00BC: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> nop <null> ldloc.0 <null> ldnull <null> ldsfld System.String Nuclear_Explosion.Atomic::App call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldc.i4.1 <null> call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean) pop <null> leave IL_00B1: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_00B1: nop nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_00BC: nop nop <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() ldloc.0 <null> ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse IL_00E8: call System.String System.IO.Path::GetTempPath() call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Void System.Diagnostics.Process::Kill() nop <null> call System.String System.IO.Path::GetTempPath() ldc.i4 350 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.File::ReadAllText(System.String) stsfld System.String Nuclear_Explosion.Atomic::App leave IL_011B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_011B: nop nop <null> nop <null> ldsfld Nuclear_Explosion.Atomic Nuclear_Explosion.Atomic::SCG callvirt System.Void Nuclear_Explosion.Atomic::Execute() nop <null> ret <null>
Module Name	Nuclear Explosion.exe
Full Name	Nuclear Explosion.exe
EntryPoint	System.Void Nuclear_Explosion.Atomic::Main()
Scope Name	Nuclear Explosion.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Nuclear Explosion
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	42
Main Method	System.Void Nuclear_Explosion.Atomic::Main()
Main IL Instruction Count	91
Main IL	br IL_0007: nop pop <null> ldc.i4.0 <null> nop <null> nop <null> nop <null> ldc.i4 206 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.Environment::GetEnvironmentVariable(System.String) ldc.i4 222 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) stloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() ldloc.0 <null> ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> cgt.un <null> stloc.1 <null> ldloc.1 <null> brfalse IL_0068: nop call System.String System.IO.Path::GetTempPath() ldc.i4 318 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.Windows.Forms.Application::get_ExecutablePath() call System.Void System.IO.File::WriteAllText(System.String,System.String) nop <null> nop <null> nop <null> ldloc.0 <null> ldnull <null> ldsfld System.String Nuclear_Explosion.Atomic::App call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldc.i4.0 <null> call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean) pop <null> leave IL_00BC: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> nop <null> ldloc.0 <null> ldnull <null> ldsfld System.String Nuclear_Explosion.Atomic::App call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldc.i4.1 <null> call System.Boolean BLjsBuvKVlRj2MKW0X.mG62oANr4jx0wP4HJO::u55CyN0gE(System.String,System.String,System.Byte[],System.Boolean) pop <null> leave IL_00B1: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_00B1: nop nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_00BC: nop nop <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() ldloc.0 <null> ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse IL_00E8: call System.String System.IO.Path::GetTempPath() call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Void System.Diagnostics.Process::Kill() nop <null> call System.String System.IO.Path::GetTempPath() ldc.i4 350 call System.String at2y0bgxVD5QHkKIJf.s125XNdA5wMOGS9Ywn::zeWpEv8Gm(System.Int32) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.File::ReadAllText(System.String) stsfld System.String Nuclear_Explosion.Atomic::App leave IL_011B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_011B: nop nop <null> nop <null> ldsfld Nuclear_Explosion.Atomic Nuclear_Explosion.Atomic::SCG callvirt System.Void Nuclear_Explosion.Atomic::Execute() nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.