Malicious
Malicious

36cf6c012aeaa9e956a7ee0815bee9fa

Share on LinkedIn
Print
PE Executable
MD5: 36cf6c012aeaa9e956a7ee0815bee9fa
Size: 1.11 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 36cf6c012aeaa9e956a7ee0815bee9fa
Sha1 bee714844d3f0658a658bf37c6f8106ad311522d
Sha256 d8ef460c9a9914057ee4ccd122e74ca078a6b09e03f8b4a2f99a4139a78df29d
Sha384 b535964028f9b3a27e0421f2c8be118333a20728bce5f1c16a40a75bcbbe481b3b59e0aed4de4ce2249ebc2536944c41
Sha512 532e8a7e001d654a3bb14bad7390ae6202f5a0339e4a48911def9089a1e5ce425fb7b0ec3794cece533814aa2195574da4e6c582abfd6141e802e507e1670da2
SSDeep 24576:03OzB09Pzy4024DjyKNUlaXXPYGItBwJ:03WBCe40tjy0UIYdBw
TLSH 7835F11912D84F94EABF97384435001983F7BC165E36DBDD2E8C5DAE372A7808AD1B27
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
36cf6c012aeaa9e956a7ee0815bee9fa
Malicious
.Net Reflective Loader
Malicious
Gontoba.kelaixja.aab [AES Decrypted]
Malicious
.Net Resources
CollectorTracer.AttributeTask
DistributorTask.VisitorTask
SimpleTask.TaskFormatter
TaskConfiguration.AuthenticatorTask
Overlay_7940c33a.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Gontoba.kelaixja.aab
gKj06mJp.Resources.resources
04b1d1683e4fde.Resources.resources
50d18d630
[NBF]root.Data
50d18d631
[NBF]root.Data
50d18d6310
[NBF]root.Data
50d18d6311
[NBF]root.Data
50d18d6312
[NBF]root.Data
50d18d6313
[NBF]root.Data
50d18d6314
[NBF]root.Data
50d18d6315
[NBF]root.Data
50d18d6316
[NBF]root.Data
50d18d6317
[NBF]root.Data
50d18d6318
[NBF]root.Data
50d18d6319
[NBF]root.Data
50d18d632
[NBF]root.Data
50d18d6320
[NBF]root.Data
50d18d6321
[NBF]root.Data
50d18d6322
[NBF]root.Data
50d18d633
[NBF]root.Data
50d18d634
[NBF]root.Data
50d18d635
[NBF]root.Data
50d18d636
[NBF]root.Data
50d18d637
[NBF]root.Data
50d18d638
[NBF]root.Data
50d18d639
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:dll~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll~T1059.007>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
gKj06mJp
Full Name
gKj06mJp
EntryPoint
System.Void gKj06mJp.2Bczmo::eYi80ofWmG5k()
Scope Name
gKj06mJp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gKj06mJp
Assembly Version
12.23.27.134
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
814
Main Method
System.Void gKj06mJp.2Bczmo::eYi80ofWmG5k()
Main IL Instruction Count
4
Main IL 
nop <null>
newobj System.Void gKj06mJp.3peBdHm::.ctor()
stloc.1 <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
gKj06mJp
Full Name
gKj06mJp
EntryPoint
System.Void gKj06mJp.2Bczmo::eYi80ofWmG5k()
Scope Name
gKj06mJp
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gKj06mJp
Assembly Version
12.23.27.134
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
814
Main Method
System.Void gKj06mJp.2Bczmo::eYi80ofWmG5k()
Main IL Instruction Count
4
Main IL 
nop <null>
newobj System.Void gKj06mJp.3peBdHm::.ctor()
stloc.1 <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙