Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.22 MB · 1,216,512 B
First seen
2026-07-14 03:16 · 3 months ago
Last seen
2026-07-14 03:16 · 3 months ago
Last analysis
2026-07-14 03:16 · 3 months ago
Hashes
MD5 34c3f92bf36ced3543c545065cfe6095 Sha1 c72b9041cad9d401989976bee11a8a08b99153e8 Sha256 3bce373a6a8b4a35e50d54469fe16ad229267578960589bdc6951195b6de98fb Sha384 85f330d4de10eb60a11b47529522ce6feb0dfc1e30a811c53b20c6e50471a26f44305e6ec73f906ac7a1e4681106f8c6 Sha512 5b539e4570a4e2af3f84bf95ad4bd7d856346dbc5e85213adb7464c251499db06f6c4a395f04bd906f6bdc323b4c48169c01c05a9ece483fb66cedd2ed029089 SSDeep 12288:GfG5ANoT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yh8G1R12Vg5CkCThajRtvA2pV:GuZ2UxAPqGcv/+Duyx4O0kYa9tvlp TLSH A745E1259D466635CA3C0A74C0D6749C13F0FEF79296E71A2EE831ECDB727A4A9D3081
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
2 malicious · 66 files
EXE34c3f92bf36ced3543c545065cfe6095.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
IMGID:0
IMGID:0-preview.png
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
BINID:0
BINID:0037
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TIFFGenitalk.klaoxao.tiff
BIN5baGw7Xx6Mo_n0.Resources.resources
BIN30ab1b76b00fd7.Resources.resources
BIN56406e9b0
DATA[NBF]root.Data
BIN56406e9b1
DATA[NBF]root.Data
BIN56406e9b10
DATA[NBF]root.Data
BIN56406e9b11
DATA[NBF]root.Data
BIN56406e9b12
DATA[NBF]root.Data
BIN56406e9b13
DATA[NBF]root.Data
BIN56406e9b14
DATA[NBF]root.Data
BIN56406e9b15
DATA[NBF]root.Data
BIN56406e9b16
DATA[NBF]root.Data
BIN56406e9b17
DATA[NBF]root.Data
BIN56406e9b18
DATA[NBF]root.Data
BIN56406e9b19
DATA[NBF]root.Data
BIN56406e9b2
DATA[NBF]root.Data
BIN56406e9b20
DATA[NBF]root.Data
BIN56406e9b21
DATA[NBF]root.Data
BIN56406e9b22
DATA[NBF]root.Data
BIN56406e9b3
DATA[NBF]root.Data
BIN56406e9b4
DATA[NBF]root.Data
BIN56406e9b5
DATA[NBF]root.Data
BIN56406e9b6
DATA[NBF]root.Data
BIN56406e9b7
DATA[NBF]root.Data
BIN56406e9b8
DATA[NBF]root.Data
BIN56406e9b9
DATA[NBF]root.Data
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINObjectRequester.ScopeObject
BINScheduledObject.ObjectParser
BINDecryptorCompressor.ControllableObject
BINAuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
5baGw7Xx6Mo_n0
Full Name
5baGw7Xx6Mo_n0
EntryPoint
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Scope Name
5baGw7Xx6Mo_n0
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5baGw7Xx6Mo_n0
Assembly Version
13.11.37.199
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Main IL Instruction Count
69
Main IL 
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean dw9F3H_.0zoTa7WrpZt::Fwe0k7EkrX()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void dw9F3H_.0zoTa7WrpZt::6tfYj()
nop <null>
nop <null>
ldc.i4 658819528
ldc.i4 170
ldtoken 5baGw7Xx6Mo_n0.My.nr8N9Xagg6/3Bpd_7PaZrm8sK.rw1PR6w_q
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.3 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::of3Wi9E(System.Int32,System.Char,System.Type,System.Int32)
nop <null>
ldc.i4 618895676
ldtoken 6exWsL.oPk67gSsHmt4
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.6 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::7ofYtQ(System.Int32,System.Type,System.Int32)
call System.Void dw9F3H_.0zoTa7WrpZt::Tkr6n8yZNj2e(System.String,System.String)
ldc.i4.1 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void dw9F3H_.0zoTa7WrpZt::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
pop <null>
ret <null>
Module Name
5baGw7Xx6Mo_n0
Full Name
5baGw7Xx6Mo_n0
EntryPoint
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Scope Name
5baGw7Xx6Mo_n0
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5baGw7Xx6Mo_n0
Assembly Version
13.11.37.199
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Main IL Instruction Count
69
Main IL 
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean dw9F3H_.0zoTa7WrpZt::Fwe0k7EkrX()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void dw9F3H_.0zoTa7WrpZt::6tfYj()
nop <null>
nop <null>
ldc.i4 658819528
ldc.i4 170
ldtoken 5baGw7Xx6Mo_n0.My.nr8N9Xagg6/3Bpd_7PaZrm8sK.rw1PR6w_q
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.3 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::of3Wi9E(System.Int32,System.Char,System.Type,System.Int32)
nop <null>
ldc.i4 618895676
ldtoken 6exWsL.oPk67gSsHmt4
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.6 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::7ofYtQ(System.Int32,System.Type,System.Int32)
call System.Void dw9F3H_.0zoTa7WrpZt::Tkr6n8yZNj2e(System.String,System.String)
ldc.i4.1 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void dw9F3H_.0zoTa7WrpZt::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
pop <null>
ret <null>
2 malicious · 66 files
EXE34c3f92bf36ced3543c545065cfe6095.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙