Malicious
Malicious

369affa224fcf1f5107c7914c8d4d85e

PE Executable
MD5: 369affa224fcf1f5107c7914c8d4d85e
Size: 825.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 369affa224fcf1f5107c7914c8d4d85e
Sha1 12ca315b295820427a520a0467f6e8334d1bec04
Sha256 b6e7280ba661be15d93b1f814579580eb7c93e699353a5e79b1e219dec4283ca
Sha384 a49d46f4a385ca914bbe18d323551d9f484787f46a4e4a60b55315bf8d573a3afb5b87ae701dd04bac935e8ac016c7eb
Sha512 8c66519cfb4b8cbf7f53afd06e0e0e95e7ad84088d186707ee5cf91fb925ac6a8744897f491a596b64c198022b0d5584354b94e5eecf8b817fbe6e11d54bc111
SSDeep 12288:+zGxm1wz9pSazjSF/7uEUQtX/NA/9FxVIrXeJsD:YtAphzjU/SEUTqrtD
TLSH B805BE6A72924F22C2891373C1C6490197EAA64776ABF70B32C413D60D463FEDE476DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
369affa224fcf1f5107c7914c8d4d85e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0L0tvY6ALjx2wIa14E.CYqIT6mdynQvErFXoO
25FRCMdgmQWQPCVYCK.MVZjBd4458ZDNZHqKW
hXw7nI9EQb5hggH6YE.rZfWm536nutAG7cnqF
Pcnnjp0JgJsGu6KTl9.Dyjf5OBomfyxcmxLL7
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nzqmw.exe
Full Name
Nzqmw.exe
EntryPoint
System.Void tUV457gabLDVPb4Cnb.qioSl2283EtyNFx9M6::cIrpvIiD6()
Scope Name
Nzqmw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nzqmw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tUV457gabLDVPb4Cnb.qioSl2283EtyNFx9M6::cIrpvIiD6()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0039: nop
ret <null>
nop <null>
ldsfld MoU7Pq2dMFZG28bmBXE MoU7Pq2dMFZG28bmBXE::x6n24WcBVU
call System.Byte[] MoU7Pq2dMFZG28bmBXE::GoF2W9Ux5q(MoU7Pq2dMFZG28bmBXE)
stloc.s V_0
ldc.i4 2
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_e05e059d077b4462a9b3e424c9261e32
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 1709562323
ldc.i4 1709562323
neg <null>
ldc.i4 -524586915
xor <null>
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_3996c7643eea4e379c04574c8370f05e
xor <null>
ldsfld RfkyJ522TFHrlL7BRgA RfkyJ522TFHrlL7BRgA::s7u2gX0DGx
call System.String RfkyJ522TFHrlL7BRgA::GoF2W9Ux5q(System.Int32,RfkyJ522TFHrlL7BRgA)
ldc.i4 -1647508052
ldc.i4 -412331032
xor <null>
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_3996c7643eea4e379c04574c8370f05e
xor <null>
ldsfld RfkyJ522TFHrlL7BRgA RfkyJ522TFHrlL7BRgA::s7u2gX0DGx
call System.String RfkyJ522TFHrlL7BRgA::GoF2W9Ux5q(System.Int32,RfkyJ522TFHrlL7BRgA)
newobj System.Void imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld dmBWbE2pGHOaqX4T6F1 dmBWbE2pGHOaqX4T6F1::Ue52DFcq5G
call imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6 dmBWbE2pGHOaqX4T6F1::GoF2W9Ux5q(System.Object,System.Byte[],dmBWbE2pGHOaqX4T6F1)
ldsfld MJGTYu2HQMaUws1h0ja MJGTYu2HQMaUws1h0ja::xue2vOPN1W
call imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6 MJGTYu2HQMaUws1h0ja::GoF2W9Ux5q(System.Object,MJGTYu2HQMaUws1h0ja)
ldsfld aHtdjw2PFjLaIyWEO8l aHtdjw2PFjLaIyWEO8l::ghr2kkQNhp
call System.Void aHtdjw2PFjLaIyWEO8l::GoF2W9Ux5q(System.Object,aHtdjw2PFjLaIyWEO8l)
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_8b24e2b655824ba7aea3c7f5ed50d1f0
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_4bba1fc0a4a64562bea75fd0416a73c5
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 1
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_014F: ldloc V_1
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_e05e059d077b4462a9b3e424c9261e32
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld SMmXkj29vaKA59tKPxu SMmXkj29vaKA59tKPxu::rlc23d9WYU
call System.Void SMmXkj29vaKA59tKPxu::GoF2W9Ux5q(SMmXkj29vaKA59tKPxu)
ldc.i4 6
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_5cc36da6514f4847a4a4b71ed1a06b1a
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
Module Name
Nzqmw.exe
Full Name
Nzqmw.exe
EntryPoint
System.Void tUV457gabLDVPb4Cnb.qioSl2283EtyNFx9M6::cIrpvIiD6()
Scope Name
Nzqmw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nzqmw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tUV457gabLDVPb4Cnb.qioSl2283EtyNFx9M6::cIrpvIiD6()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0039: nop
ret <null>
nop <null>
ldsfld MoU7Pq2dMFZG28bmBXE MoU7Pq2dMFZG28bmBXE::x6n24WcBVU
call System.Byte[] MoU7Pq2dMFZG28bmBXE::GoF2W9Ux5q(MoU7Pq2dMFZG28bmBXE)
stloc.s V_0
ldc.i4 2
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_e05e059d077b4462a9b3e424c9261e32
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 1709562323
ldc.i4 1709562323
neg <null>
ldc.i4 -524586915
xor <null>
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_3996c7643eea4e379c04574c8370f05e
xor <null>
ldsfld RfkyJ522TFHrlL7BRgA RfkyJ522TFHrlL7BRgA::s7u2gX0DGx
call System.String RfkyJ522TFHrlL7BRgA::GoF2W9Ux5q(System.Int32,RfkyJ522TFHrlL7BRgA)
ldc.i4 -1647508052
ldc.i4 -412331032
xor <null>
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_3996c7643eea4e379c04574c8370f05e
xor <null>
ldsfld RfkyJ522TFHrlL7BRgA RfkyJ522TFHrlL7BRgA::s7u2gX0DGx
call System.String RfkyJ522TFHrlL7BRgA::GoF2W9Ux5q(System.Int32,RfkyJ522TFHrlL7BRgA)
newobj System.Void imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld dmBWbE2pGHOaqX4T6F1 dmBWbE2pGHOaqX4T6F1::Ue52DFcq5G
call imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6 dmBWbE2pGHOaqX4T6F1::GoF2W9Ux5q(System.Object,System.Byte[],dmBWbE2pGHOaqX4T6F1)
ldsfld MJGTYu2HQMaUws1h0ja MJGTYu2HQMaUws1h0ja::xue2vOPN1W
call imH7gt0fnmeltW15MRn.A7jWGy0WsDS8mhsQLP6 MJGTYu2HQMaUws1h0ja::GoF2W9Ux5q(System.Object,MJGTYu2HQMaUws1h0ja)
ldsfld aHtdjw2PFjLaIyWEO8l aHtdjw2PFjLaIyWEO8l::ghr2kkQNhp
call System.Void aHtdjw2PFjLaIyWEO8l::GoF2W9Ux5q(System.Object,aHtdjw2PFjLaIyWEO8l)
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_8b24e2b655824ba7aea3c7f5ed50d1f0
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_4bba1fc0a4a64562bea75fd0416a73c5
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 1
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_014F: ldloc V_1
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_e05e059d077b4462a9b3e424c9261e32
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld SMmXkj29vaKA59tKPxu SMmXkj29vaKA59tKPxu::rlc23d9WYU
call System.Void SMmXkj29vaKA59tKPxu::GoF2W9Ux5q(SMmXkj29vaKA59tKPxu)
ldc.i4 6
ldsfld <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788} <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_1e5cb0e0216e468a846b462dc989004b
ldfld System.Int32 <Module>{e5c96532-f0db-4aa1-98a7-98f047efe788}::m_5cc36da6514f4847a4a4b71ed1a06b1a
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
369affa224fcf1f5107c7914c8d4d85e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0L0tvY6ALjx2wIa14E.CYqIT6mdynQvErFXoO
25FRCMdgmQWQPCVYCK.MVZjBd4458ZDNZHqKW
hXw7nI9EQb5hggH6YE.rZfWm536nutAG7cnqF
Pcnnjp0JgJsGu6KTl9.Dyjf5OBomfyxcmxLL7
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙