Malicious
Malicious

27fc1568dce3fddc5a10eb955c1c3b86

PE Executable
MD5: 27fc1568dce3fddc5a10eb955c1c3b86
Size: 851.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 27fc1568dce3fddc5a10eb955c1c3b86
Sha1 0aa0ae0a0297ba2f8738e3ce01d64752c1dc7591
Sha256 d28343fff34a5ebc030fb7e1d967acc0df11645e651935b53578787b4786a8fa
Sha384 e0885e5e2dc66a449f3b93588a7a4670cf274feb45bbec16fa5a28b650df83bd9f7495e15848268456b991523b0ee3c3
Sha512 9e3bb2121cf7092f4f4c5cfc2dc2b075c50f07ec1acb804258c90c9a6d1bb58c644893776caecf8afa0abde78ecb7afb3e073a802842b2732302d465de48d562
SSDeep 12288:loFsD0ancMvZF8gTPHjibsZdmtYhMN12sboHqLV/fq5ZLIj9rTooC3qXHslK/lff:lOuvZF8gDjibs941os/fK5I5zhRLR8
TLSH 4B05CE042656EC12C5E906B5C8D1D2FF06B05E8BE452F24B5ADA3EAF3A31791F7942C3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
27fc1568dce3fddc5a10eb955c1c3b86
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
J4w.X45.resources
$this.Icon
[NBF]root.IconData
Krki.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TeaEstate.Properties.Resources.resources
Pol
[NBF]root.Data
yJfH
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Krki.exe
Full Name
Krki.exe
EntryPoint
System.Void zL.Xd::DW()
Scope Name
Krki.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Krki
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
432
Main Method
System.Void zL.Xd::DW()
Main IL Instruction Count
43
Main IL 
br IL_0078: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AD: nop
nop <null>
newobj System.Void TI6.PIG::.ctor()
stsfld TI6.PIG zL.Xd::qe
br IL_0027: newobj System.Void J4w.X45::.ctor()
newobj System.Void J4w.X45::.ctor()
stsfld J4w.X45 zL.Xd::pv
br IL_0069: newobj System.Void K4q.G4H::.ctor()
call System.Void zRj.QRS::qsv()
ldc.i4 0
ldsfld <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d} <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_f46d9d9b0cbc45b898feb97e7da697bc
ldfld System.Int32 <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_528eef18f4a14c72ab3df88407632f7b
brtrue IL_0009: switch(IL_00AD)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_00AD)
newobj System.Void gOV.GOJ::.ctor()
stsfld gOV.GOJ zL.Xd::Sr
br IL_009E: ldsfld gOV.GOJ zL.Xd::Sr
newobj System.Void K4q.G4H::.ctor()
stsfld K4q.G4H zL.Xd::nu
br IL_008F: newobj System.Void GDh.xDM::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0083: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0036: call System.Void zRj.QRS::qsv()
newobj System.Void GDh.xDM::.ctor()
stsfld GDh.xDM zL.Xd::Bf
br IL_005A: newobj System.Void gOV.GOJ::.ctor()
ldsfld gOV.GOJ zL.Xd::Sr
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00B8: nop
nop <null>
call System.Void zL.Xd::Aa()
br IL_0017: nop
nop <null>
ret <null>
Module Name
Krki.exe
Full Name
Krki.exe
EntryPoint
System.Void zL.Xd::DW()
Scope Name
Krki.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Krki
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void zL.Xd::DW()
Main IL Instruction Count
43
Main IL 
br IL_0078: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AD: nop
nop <null>
newobj System.Void TI6.PIG::.ctor()
stsfld TI6.PIG zL.Xd::qe
br IL_0027: newobj System.Void J4w.X45::.ctor()
newobj System.Void J4w.X45::.ctor()
stsfld J4w.X45 zL.Xd::pv
br IL_0069: newobj System.Void K4q.G4H::.ctor()
call System.Void zRj.QRS::qsv()
ldc.i4 0
ldsfld <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d} <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_f46d9d9b0cbc45b898feb97e7da697bc
ldfld System.Int32 <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_528eef18f4a14c72ab3df88407632f7b
brtrue IL_0009: switch(IL_00AD)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_00AD)
newobj System.Void gOV.GOJ::.ctor()
stsfld gOV.GOJ zL.Xd::Sr
br IL_009E: ldsfld gOV.GOJ zL.Xd::Sr
newobj System.Void K4q.G4H::.ctor()
stsfld K4q.G4H zL.Xd::nu
br IL_008F: newobj System.Void GDh.xDM::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0083: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0036: call System.Void zRj.QRS::qsv()
newobj System.Void GDh.xDM::.ctor()
stsfld GDh.xDM zL.Xd::Bf
br IL_005A: newobj System.Void gOV.GOJ::.ctor()
ldsfld gOV.GOJ zL.Xd::Sr
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00B8: nop
nop <null>
call System.Void zL.Xd::Aa()
br IL_0017: nop
nop <null>
ret <null>
27fc1568dce3fddc5a10eb955c1c3b86
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
J4w.X45.resources
$this.Icon
[NBF]root.IconData
Krki.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TeaEstate.Properties.Resources.resources
Pol
[NBF]root.Data
yJfH
[NBF]root.Data
[NBF]root.Data-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙