Malicious
Malicious

27fc1568dce3fddc5a10eb955c1c3b86

Share on LinkedIn
Print
PE Executable
MD5: 27fc1568dce3fddc5a10eb955c1c3b86
Size: 851.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 27fc1568dce3fddc5a10eb955c1c3b86
Sha1 0aa0ae0a0297ba2f8738e3ce01d64752c1dc7591
Sha256 d28343fff34a5ebc030fb7e1d967acc0df11645e651935b53578787b4786a8fa
Sha384 e0885e5e2dc66a449f3b93588a7a4670cf274feb45bbec16fa5a28b650df83bd9f7495e15848268456b991523b0ee3c3
Sha512 9e3bb2121cf7092f4f4c5cfc2dc2b075c50f07ec1acb804258c90c9a6d1bb58c644893776caecf8afa0abde78ecb7afb3e073a802842b2732302d465de48d562
SSDeep 12288:loFsD0ancMvZF8gTPHjibsZdmtYhMN12sboHqLV/fq5ZLIj9rTooC3qXHslK/lff:lOuvZF8gDjibs941os/fK5I5zhRLR8
TLSH 4B05CE042656EC12C5E906B5C8D1D2FF06B05E8BE452F24B5ADA3EAF3A31791F7942C3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
27fc1568dce3fddc5a10eb955c1c3b86
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
J4w.X45.resources
$this.Icon
[NBF]root.IconData
Krki.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TeaEstate.Properties.Resources.resources
Pol
[NBF]root.Data
yJfH
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Krki.exe
Full Name
Krki.exe
EntryPoint
System.Void zL.Xd::DW()
Scope Name
Krki.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Krki
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
432
Main Method
System.Void zL.Xd::DW()
Main IL Instruction Count
43
Main IL 
br IL_0078: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AD: nop
nop <null>
newobj System.Void TI6.PIG::.ctor()
stsfld TI6.PIG zL.Xd::qe
br IL_0027: newobj System.Void J4w.X45::.ctor()
newobj System.Void J4w.X45::.ctor()
stsfld J4w.X45 zL.Xd::pv
br IL_0069: newobj System.Void K4q.G4H::.ctor()
call System.Void zRj.QRS::qsv()
ldc.i4 0
ldsfld <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d} <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_f46d9d9b0cbc45b898feb97e7da697bc
ldfld System.Int32 <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_528eef18f4a14c72ab3df88407632f7b
brtrue IL_0009: switch(IL_00AD)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_00AD)
newobj System.Void gOV.GOJ::.ctor()
stsfld gOV.GOJ zL.Xd::Sr
br IL_009E: ldsfld gOV.GOJ zL.Xd::Sr
newobj System.Void K4q.G4H::.ctor()
stsfld K4q.G4H zL.Xd::nu
br IL_008F: newobj System.Void GDh.xDM::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0083: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0036: call System.Void zRj.QRS::qsv()
newobj System.Void GDh.xDM::.ctor()
stsfld GDh.xDM zL.Xd::Bf
br IL_005A: newobj System.Void gOV.GOJ::.ctor()
ldsfld gOV.GOJ zL.Xd::Sr
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00B8: nop
nop <null>
call System.Void zL.Xd::Aa()
br IL_0017: nop
nop <null>
ret <null>
Module Name
Krki.exe
Full Name
Krki.exe
EntryPoint
System.Void zL.Xd::DW()
Scope Name
Krki.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Krki
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void zL.Xd::DW()
Main IL Instruction Count
43
Main IL 
br IL_0078: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AD: nop
nop <null>
newobj System.Void TI6.PIG::.ctor()
stsfld TI6.PIG zL.Xd::qe
br IL_0027: newobj System.Void J4w.X45::.ctor()
newobj System.Void J4w.X45::.ctor()
stsfld J4w.X45 zL.Xd::pv
br IL_0069: newobj System.Void K4q.G4H::.ctor()
call System.Void zRj.QRS::qsv()
ldc.i4 0
ldsfld <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d} <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_f46d9d9b0cbc45b898feb97e7da697bc
ldfld System.Int32 <Module>{e8f12fde-7c13-44f1-86c9-dc4c312dc52d}::m_528eef18f4a14c72ab3df88407632f7b
brtrue IL_0009: switch(IL_00AD)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_00AD)
newobj System.Void gOV.GOJ::.ctor()
stsfld gOV.GOJ zL.Xd::Sr
br IL_009E: ldsfld gOV.GOJ zL.Xd::Sr
newobj System.Void K4q.G4H::.ctor()
stsfld K4q.G4H zL.Xd::nu
br IL_008F: newobj System.Void GDh.xDM::.ctor()
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0083: nop
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0036: call System.Void zRj.QRS::qsv()
newobj System.Void GDh.xDM::.ctor()
stsfld GDh.xDM zL.Xd::Bf
br IL_005A: newobj System.Void gOV.GOJ::.ctor()
ldsfld gOV.GOJ zL.Xd::Sr
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_00B8: nop
nop <null>
call System.Void zL.Xd::Aa()
br IL_0017: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙