Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 34c3f92bf36ced3543c545065cfe6095
Sha1 c72b9041cad9d401989976bee11a8a08b99153e8
Sha256 3bce373a6a8b4a35e50d54469fe16ad229267578960589bdc6951195b6de98fb
Sha384 85f330d4de10eb60a11b47529522ce6feb0dfc1e30a811c53b20c6e50471a26f44305e6ec73f906ac7a1e4681106f8c6
Sha512 5b539e4570a4e2af3f84bf95ad4bd7d856346dbc5e85213adb7464c251499db06f6c4a395f04bd906f6bdc323b4c48169c01c05a9ece483fb66cedd2ed029089
SSDeep 12288:GfG5ANoT2CPpHAP/iGc1ZOM+FhWF2hekxpp4yh8G1R12Vg5CkCThajRtvA2pV:GuZ2UxAPqGcv/+Duyx4O0kYa9tvlp
TLSH A745E1259D466635CA3C0A74C0D6749C13F0FEF79296E71A2EE831ECDB727A4A9D3081
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
34c3f92bf36ced3543c545065cfe6095
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
5baGw7Xx6Mo_n0.Resources.resources
30ab1b76b00fd7.Resources.resources
56406e9b0
[NBF]root.Data
56406e9b1
[NBF]root.Data
56406e9b10
[NBF]root.Data
56406e9b11
[NBF]root.Data
56406e9b12
[NBF]root.Data
56406e9b13
[NBF]root.Data
56406e9b14
[NBF]root.Data
56406e9b15
[NBF]root.Data
56406e9b16
[NBF]root.Data
56406e9b17
[NBF]root.Data
56406e9b18
[NBF]root.Data
56406e9b19
[NBF]root.Data
56406e9b2
[NBF]root.Data
56406e9b20
[NBF]root.Data
56406e9b21
[NBF]root.Data
56406e9b22
[NBF]root.Data
56406e9b3
[NBF]root.Data
56406e9b4
[NBF]root.Data
56406e9b5
[NBF]root.Data
56406e9b6
[NBF]root.Data
56406e9b7
[NBF]root.Data
56406e9b8
[NBF]root.Data
56406e9b9
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
5baGw7Xx6Mo_n0
Full Name
5baGw7Xx6Mo_n0
EntryPoint
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Scope Name
5baGw7Xx6Mo_n0
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5baGw7Xx6Mo_n0
Assembly Version
13.11.37.199
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Main IL Instruction Count
69
Main IL 
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean dw9F3H_.0zoTa7WrpZt::Fwe0k7EkrX()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void dw9F3H_.0zoTa7WrpZt::6tfYj()
nop <null>
nop <null>
ldc.i4 658819528
ldc.i4 170
ldtoken 5baGw7Xx6Mo_n0.My.nr8N9Xagg6/3Bpd_7PaZrm8sK.rw1PR6w_q
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.3 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::of3Wi9E(System.Int32,System.Char,System.Type,System.Int32)
nop <null>
ldc.i4 618895676
ldtoken 6exWsL.oPk67gSsHmt4
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.6 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::7ofYtQ(System.Int32,System.Type,System.Int32)
call System.Void dw9F3H_.0zoTa7WrpZt::Tkr6n8yZNj2e(System.String,System.String)
ldc.i4.1 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void dw9F3H_.0zoTa7WrpZt::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
pop <null>
ret <null>
Module Name
5baGw7Xx6Mo_n0
Full Name
5baGw7Xx6Mo_n0
EntryPoint
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Scope Name
5baGw7Xx6Mo_n0
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5baGw7Xx6Mo_n0
Assembly Version
13.11.37.199
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
Main IL Instruction Count
69
Main IL 
ldc.i4.3 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.6 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean dw9F3H_.0zoTa7WrpZt::Fwe0k7EkrX()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.5 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void dw9F3H_.0zoTa7WrpZt::6tfYj()
nop <null>
nop <null>
ldc.i4 658819528
ldc.i4 170
ldtoken 5baGw7Xx6Mo_n0.My.nr8N9Xagg6/3Bpd_7PaZrm8sK.rw1PR6w_q
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.3 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::of3Wi9E(System.Int32,System.Char,System.Type,System.Int32)
nop <null>
ldc.i4 618895676
ldtoken 6exWsL.oPk67gSsHmt4
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.6 <null>
call System.String 2rnKT8.mb2CF9cqw_5M/5foNdTp68cxCF.Rpt6rp4My0Dg::7ofYtQ(System.Int32,System.Type,System.Int32)
call System.Void dw9F3H_.0zoTa7WrpZt::Tkr6n8yZNj2e(System.String,System.String)
ldc.i4.1 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void dw9F3H_.0zoTa7WrpZt::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void dw9F3H_.0zoTa7WrpZt::9gaNotA3k2cQrL()
pop <null>
ret <null>
34c3f92bf36ced3543c545065cfe6095
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0-preview.png
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
5baGw7Xx6Mo_n0.Resources.resources
30ab1b76b00fd7.Resources.resources
56406e9b0
[NBF]root.Data
56406e9b1
[NBF]root.Data
56406e9b10
[NBF]root.Data
56406e9b11
[NBF]root.Data
56406e9b12
[NBF]root.Data
56406e9b13
[NBF]root.Data
56406e9b14
[NBF]root.Data
56406e9b15
[NBF]root.Data
56406e9b16
[NBF]root.Data
56406e9b17
[NBF]root.Data
56406e9b18
[NBF]root.Data
56406e9b19
[NBF]root.Data
56406e9b2
[NBF]root.Data
56406e9b20
[NBF]root.Data
56406e9b21
[NBF]root.Data
56406e9b22
[NBF]root.Data
56406e9b3
[NBF]root.Data
56406e9b4
[NBF]root.Data
56406e9b5
[NBF]root.Data
56406e9b6
[NBF]root.Data
56406e9b7
[NBF]root.Data
56406e9b8
[NBF]root.Data
56406e9b9
[NBF]root.Data
.Net Reflective Loader
Malicious
Genitalk.klaoxao.tiff [AES Decrypted]
Malicious
Overlay_ddd3db78.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ObjectRequester.ScopeObject
ScheduledObject.ObjectParser
DecryptorCompressor.ControllableObject
AuditorMap.LocalObject
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙