Malicious
Malicious

2a3379120119c12e6281193c3f864c80

Share on LinkedIn
Print
PE Executable
MD5: 2a3379120119c12e6281193c3f864c80
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 2a3379120119c12e6281193c3f864c80
Sha1 65da6850d086d2fbeff693f9c1499fda09f91895
Sha256 59c292aaa6b81e0de85fd7f463c7042f680c49e00f7e0027e6d0940a0fc88d9e
Sha384 a302c603c763aa53f02cd99932838d8ff29ea0cf336ce1a1223055ea808027544bbb46fb5b7e3538222cb943112695e1
Sha512 5df1c24f52cf19a8387a208abaf766ae540b98a2d69a451833d5ef83af545109ae3aae1012a7f4806db9d3eabf9223937f6455665d2a0ee96fcbe7c8eafa775d
SSDeep 12288:1ByztY2aSj3MXu3/JkC09wlvGiKKkUkcQGek0S2ZMQGYqX:QaKOuhkZKdGakVnk0xGY
TLSH 0205BF3B72958F21C24A4373C5D7450097EA964776ABFB0F72C813D619427FECA0A29B
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2a3379120119c12e6281193c3f864c80
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
5dgjDvOcuo27mToxsK.AmKjgZu05mqLUXyRh1
XfgYJg8RSDvMNwOSwS.9FXSCEsdCj0xlk55LJ
2XBZx6r5gSUCcW3QVt.1mLqU4RiSoJxMvQuFW
KviKq8GPSJP4a0riSp.QEUmpl6AwoNlbKYFyl
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Exqwd.exe
Full Name
Exqwd.exe
EntryPoint
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Scope Name
Exqwd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Exqwd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
call System.Void XbNMaPhOovlbmkmTx3o::ICuhBp6JlN(XbNMaPhOovlbmkmTx3o)
ldc.i4 0
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_d7f846c492364061bf4850e34f26d0f6
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TryhJlh8ypqUvNlAUNx TryhJlh8ypqUvNlAUNx::oachsrrV91
call System.Byte[] TryhJlh8ypqUvNlAUNx::ICuhBp6JlN(TryhJlh8ypqUvNlAUNx)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_ec657c22232947c6b508401c4b06e2e8
brtrue IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 -668656547
ldc.i4 -668656547
ldc.i4 -322320711
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_96c2da759fa74246966270b5716545da
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
ldc.i4 -652038019
ldc.i4 -493661374
add <null>
ldc.i4 -1909934641
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f82dab4d0f2147adb1a56fad8adc3149
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
newobj System.Void jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Mb4MGYhjlGxlYAMppM0 Mb4MGYhjlGxlYAMppM0::FI1h57W0Qx
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv Mb4MGYhjlGxlYAMppM0::ICuhBp6JlN(System.Object,System.Byte[],Mb4MGYhjlGxlYAMppM0)
ldsfld fJ1ImqhPpGPDFnOw8V0 fJ1ImqhPpGPDFnOw8V0::NqyhvERlyd
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv fJ1ImqhPpGPDFnOw8V0::ICuhBp6JlN(System.Object,fJ1ImqhPpGPDFnOw8V0)
ldsfld f3WuKAhmxwEEGOtlJfc f3WuKAhmxwEEGOtlJfc::UZZhXviXU0
call System.Void f3WuKAhmxwEEGOtlJfc::ICuhBp6JlN(System.Object,f3WuKAhmxwEEGOtlJfc)
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_24b2eaab7e2447b1975726a3488fed3f
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f44ef77d57474824965db05b3e40a287
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 3
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_9e4266a8c019405b9f669651c5408caa
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Exqwd.exe
Full Name
Exqwd.exe
EntryPoint
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Scope Name
Exqwd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Exqwd
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void T1mqunkUKYkesqgCAg.eRugVAhVPCkwhJXdIm::XtZjw5mn0()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
ldsfld XbNMaPhOovlbmkmTx3o XbNMaPhOovlbmkmTx3o::UYdhuNOj8y
call System.Void XbNMaPhOovlbmkmTx3o::ICuhBp6JlN(XbNMaPhOovlbmkmTx3o)
ldc.i4 0
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_d7f846c492364061bf4850e34f26d0f6
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld TryhJlh8ypqUvNlAUNx TryhJlh8ypqUvNlAUNx::oachsrrV91
call System.Byte[] TryhJlh8ypqUvNlAUNx::ICuhBp6JlN(TryhJlh8ypqUvNlAUNx)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_ec657c22232947c6b508401c4b06e2e8
brtrue IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_014A)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 -668656547
ldc.i4 -668656547
ldc.i4 -322320711
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_96c2da759fa74246966270b5716545da
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
ldc.i4 -652038019
ldc.i4 -493661374
add <null>
ldc.i4 -1909934641
xor <null>
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f82dab4d0f2147adb1a56fad8adc3149
xor <null>
ldsfld fpZP3ShhaKuFNd5eV5B fpZP3ShhaKuFNd5eV5B::Nj6hk4jE0C
call System.String fpZP3ShhaKuFNd5eV5B::ICuhBp6JlN(System.Int32,fpZP3ShhaKuFNd5eV5B)
newobj System.Void jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld Mb4MGYhjlGxlYAMppM0 Mb4MGYhjlGxlYAMppM0::FI1h57W0Qx
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv Mb4MGYhjlGxlYAMppM0::ICuhBp6JlN(System.Object,System.Byte[],Mb4MGYhjlGxlYAMppM0)
ldsfld fJ1ImqhPpGPDFnOw8V0 fJ1ImqhPpGPDFnOw8V0::NqyhvERlyd
call jnCiOSGICPclVIRnRoZ.FLNPtQGBArdL5QgvHSv fJ1ImqhPpGPDFnOw8V0::ICuhBp6JlN(System.Object,fJ1ImqhPpGPDFnOw8V0)
ldsfld f3WuKAhmxwEEGOtlJfc f3WuKAhmxwEEGOtlJfc::UZZhXviXU0
call System.Void f3WuKAhmxwEEGOtlJfc::ICuhBp6JlN(System.Object,f3WuKAhmxwEEGOtlJfc)
ldc.i4 1
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_24b2eaab7e2447b1975726a3488fed3f
brfalse IL_00A0: switch(IL_00C0,IL_014A)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_00C0,IL_014A)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_f44ef77d57474824965db05b3e40a287
brtrue IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 3
ldsfld <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351} <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_0ca703d9beaf45dfb29d9aec1c58d733
ldfld System.Int32 <Module>{aa0e4c4a-7247-403e-add6-7da615ba6351}::m_9e4266a8c019405b9f669651c5408caa
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙