Deep Malware Analysis of 2872b4c1c4e400dbf4c98b7d691848cf | md5: 2872b4c1c4e400dbf4c98b7d691848cf | .Net Obfuscator | Executable | PE (Portable Executable) | .Net Reactor | .Net | Managed .NET | PE File Layout | Win 64 Exe | x64 | SOS: 0.89

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	2872b4c1c4e400dbf4c98b7d691848cf
Sha1	351af0f6443e06bbab8174222c593dfb18a84586
Sha256	1e431d109f675c8c9a4cadd1c6cb40c3205db4d6634a437bcf6c8826fd57a746
Sha384	0e1602954cceeb92f0d0afdab2493b66d69a8a28a7b0f697fce1bb930a7f750d7c3c455d94ac71f9a9e61b17a5c87633
Sha512	3fd4258af14c98ec1a83d30d0bcebfd6d36ec7721b53c0532025f36269e0b669bc73ab1b5e30e981eb52ab7d3426c99480af72ae404acd24bc1a6c7c3e4c3f1f
SSDeep	12288:DZOfrHoMkq1RX9R3irp4oQUWFv5rfb62oJv8GHpiIjBMXAAKgtZxvkjt62p30K0O:8xxfX9E3MhrfGcGHN8KMZxUpvnB
TLSH	4A35CF1636624E91C2850F33C1DB950087E2A983F9E7F74FB68413661D173EEE947AA3

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	Jtwzola.exe
Full Name	Jtwzola.exe
EntryPoint	System.Void FYho8oYh0TOJTx4s6u.QH6IqUg2QxfQsNG4jA::KPYn8cvb6()
Scope Name	Jtwzola.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Jtwzola
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Info	PE Detect: PeReader OK (file layout)
Total Strings	41
Main Method	System.Void FYho8oYh0TOJTx4s6u.QH6IqUg2QxfQsNG4jA::KPYn8cvb6()
Main IL Instruction Count	96
Main IL	br.s IL_0007: ldc.i4 2 call <null> ldc.i4 2 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 990 beq IL_0010: ldloc V_3 br IL_0038: nop nop <null> ldsfld ue9x27gXXFnZEQ55OJr ue9x27gXXFnZEQ55OJr::SxKgGXpk9d call System.Byte[] ue9x27gXXFnZEQ55OJr::GcvgTQE6hg(ue9x27gXXFnZEQ55OJr) stloc.s V_1 ldc.i4 1 ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_48b823a7018946ce9856c197aef47894 brtrue IL_0076: switch(IL_0111,IL_0096) pop <null> ldc.i4 6 br IL_0076: switch(IL_0111,IL_0096) br IL_0072: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0072: ldloc V_2 br IL_0111: leave IL_0188 ldc.i4 1833299970 ldc.i4 3 shl <null> ldc.i4 649943846 xor <null> ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_da16199ad4a547c8ae71f94d569e41d6 xor <null> ldsfld Vf5CYagZpdYaN5QVLSv Vf5CYagZpdYaN5QVLSv::nxlgI27vBx call System.String Vf5CYagZpdYaN5QVLSv::GcvgTQE6hg(System.Int32,Vf5CYagZpdYaN5QVLSv) ldc.i4 1883787870 ldc.i4 591795690 xor <null> ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_8bd3a0525f5a4302a2c665c2ca205a24 xor <null> ldsfld Vf5CYagZpdYaN5QVLSv Vf5CYagZpdYaN5QVLSv::nxlgI27vBx call System.String Vf5CYagZpdYaN5QVLSv::GcvgTQE6hg(System.Int32,Vf5CYagZpdYaN5QVLSv) newobj System.Void Shq35ReBqQnDGWnuCK.FnHieJ7I5NQGM8J8Kb::.ctor(System.String,System.String) newobj System.Void DkAx3EoVHT2I0UnIkQT.gANWRpoH3G2IrhkABBQ::.ctor(Shq35ReBqQnDGWnuCK.FnHieJ7I5NQGM8J8Kb) ldloc.s V_1 ldsfld HbAi8Xg0Ce31EGn12Z0 HbAi8Xg0Ce31EGn12Z0::fJBgz8B1b1 call System.Void HbAi8Xg0Ce31EGn12Z0::GcvgTQE6hg(System.Object,System.Byte[],HbAi8Xg0Ce31EGn12Z0) ldc.i4 4 ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_a50c895659524bb39e6c8c0e20dd8fe0 brtrue IL_0076: switch(IL_0111,IL_0096) pop <null> ldc.i4 0 br IL_0076: switch(IL_0111,IL_0096) leave IL_0188: ret pop <null> ldc.i4 0 ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_3ddfc062d2144d62adb3e15972574892 brfalse IL_0148: switch(IL_0164) pop <null> ldc.i4 1 br IL_0148: switch(IL_0164) br IL_0144: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0144: ldloc V_0 br IL_0164: leave IL_0188 leave IL_0188: ret ldc.i4 4 ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_32300b491f214661bb19421a37a88bb8 brtrue IL_0014: switch(IL_0188,IL_0038,IL_0189) pop <null> ldc.i4 0 br IL_0014: switch(IL_0188,IL_0038,IL_0189) ret <null> ldsfld DOrbg5gb8bLVaVZOtWH DOrbg5gb8bLVaVZOtWH::MwKgJEA2iv call System.Void DOrbg5gb8bLVaVZOtWH::GcvgTQE6hg(DOrbg5gb8bLVaVZOtWH) ldc.i4 1 ldsfld <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3} <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_e24b4161d3224ac7a739a6a331a2adad ldfld System.Int32 <Module>{8f17317c-3e03-4aa4-a29f-6ddc8c035ea3}::m_7817444927b346cbaad14c788a4e5fcf brfalse IL_0014: switch(IL_0188,IL_0038,IL_0189) pop <null> ldc.i4 3 br IL_0014: switch(IL_0188,IL_0038,IL_0189)