Malicious
Malicious

2a3379120119c12e6281193c3f864c80

PE Executable
MD5: 2a3379120119c12e6281193c3f864c80
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 2a3379120119c12e6281193c3f864c80
Sha1 65da6850d086d2fbeff693f9c1499fda09f91895
Sha256 59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e
Sha384 a302c603c763aa53f02cd99932838d8ff29ea0cf336ce1a1223055ea808027544bbb46fb5b7e3538222cb943112695e1
Sha512 5df1c24f52cf19a8387a208abaf766ae540b98a2d69a451833d5ef83af545109ae3aae1012a7f4806db9d3eabf9223937f6455665d2a0ee96fcbe7c8eafa775d
SSDeep 12288:1ByztY2aSj3MXu3/JkC09wlvGiKKkUkcQGek0S2ZMQGYqX:QaKOuhkZKdGakVnk0xGY
TLSH 0205BF3B72958F21C24A4373C5D7450097EA964776ABFB0F72C813D619427FECA0A29B
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2a3379120119c12e6281193c3f864c80
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
5dgjDvOcuo27mToxsK.AmKjgZu05mqLUXyRh1
XfgYJg8RSDvMNwOSwS.9FXSCEsdCj0xlk55LJ
2XBZx6r5gSUCcW3QVt.1mLqU4RiSoJxMvQuFW
KviKq8GPSJP4a0riSp.QEUmpl6AwoNlbKYFyl
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Exqwd.exe
Full Name
Exqwd.exe
EntryPoint
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Scope Name
Exqwd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Exqwd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
call System.Void XbNMaPhOovlbmkmTx3o::ICuhBp6JlN(XbNMaPhOovlbmkmTx3o)
ldc.i4 0
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_d7f846c492364061bf4850e34f26d0f6
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TryhJlh8ypqUvNlAUNx TryhJlh8ypqUvNlAUNx::oachsrrV91
call System.Byte[] TryhJlh8ypqUvNlAUNx::ICuhBp6JlN(TryhJlh8ypqUvNlAUNx)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_ec657c22232947c6b508401c4b06e2e8
brtrue IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 -668656547
ldc.i4 -668656547
ldc.i4 -322320711
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_96c2da759fa74246966270b5716545da
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
ldc.i4 -652038019
ldc.i4 -493661374
add <null>
ldc.i4 -1909934641
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f82dab4d0f2147adb1a56fad8adc3149
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
newobj System.Void jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Mb4MGYhjlGxlYAMppM0 Mb4MGYhjlGxlYAMppM0::FI1h57W0Qx
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv Mb4MGYhjlGxlYAMppM0::ICuhBp6JlN(System.Object,System.Byte[],Mb4MGYhjlGxlYAMppM0)
ldsfld fJ1ImqhPpGPDFnOw8V0 fJ1ImqhPpGPDFnOw8V0::NqyhvERlyd
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv fJ1ImqhPpGPDFnOw8V0::ICuhBp6JlN(System.Object,fJ1ImqhPpGPDFnOw8V0)
ldsfld f3WuKAhmxwEEGOtlJfc f3WuKAhmxwEEGOtlJfc::UZZhXviXU0
call System.Void f3WuKAhmxwEEGOtlJfc::ICuhBp6JlN(System.Object,f3WuKAhmxwEEGOtlJfc)
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_24b2eaab7e2447b1975726a3488fed3f
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f44ef77d57474824965db05b3e40a287
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 3
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_9e4266a8c019405b9f669651c5408caa
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Exqwd.exe
Full Name
Exqwd.exe
EntryPoint
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Scope Name
Exqwd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Exqwd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
call System.Void XbNMaPhOovlbmkmTx3o::ICuhBp6JlN(XbNMaPhOovlbmkmTx3o)
ldc.i4 0
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_d7f846c492364061bf4850e34f26d0f6
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TryhJlh8ypqUvNlAUNx TryhJlh8ypqUvNlAUNx::oachsrrV91
call System.Byte[] TryhJlh8ypqUvNlAUNx::ICuhBp6JlN(TryhJlh8ypqUvNlAUNx)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_ec657c22232947c6b508401c4b06e2e8
brtrue IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 -668656547
ldc.i4 -668656547
ldc.i4 -322320711
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_96c2da759fa74246966270b5716545da
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
ldc.i4 -652038019
ldc.i4 -493661374
add <null>
ldc.i4 -1909934641
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f82dab4d0f2147adb1a56fad8adc3149
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
newobj System.Void jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Mb4MGYhjlGxlYAMppM0 Mb4MGYhjlGxlYAMppM0::FI1h57W0Qx
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv Mb4MGYhjlGxlYAMppM0::ICuhBp6JlN(System.Object,System.Byte[],Mb4MGYhjlGxlYAMppM0)
ldsfld fJ1ImqhPpGPDFnOw8V0 fJ1ImqhPpGPDFnOw8V0::NqyhvERlyd
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv fJ1ImqhPpGPDFnOw8V0::ICuhBp6JlN(System.Object,fJ1ImqhPpGPDFnOw8V0)
ldsfld f3WuKAhmxwEEGOtlJfc f3WuKAhmxwEEGOtlJfc::UZZhXviXU0
call System.Void f3WuKAhmxwEEGOtlJfc::ICuhBp6JlN(System.Object,f3WuKAhmxwEEGOtlJfc)
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_24b2eaab7e2447b1975726a3488fed3f
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f44ef77d57474824965db05b3e40a287
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 3
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_9e4266a8c019405b9f669651c5408caa
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
2a3379120119c12e6281193c3f864c80
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
5dgjDvOcuo27mToxsK.AmKjgZu05mqLUXyRh1
XfgYJg8RSDvMNwOSwS.9FXSCEsdCj0xlk55LJ
2XBZx6r5gSUCcW3QVt.1mLqU4RiSoJxMvQuFW
KviKq8GPSJP4a0riSp.QEUmpl6AwoNlbKYFyl
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙