396a9a33360a6597562033f7c6a09dfb

PE Executable

MD5: 396a9a33360a6597562033f7c6a09dfb

Size: 13.33 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	396a9a33360a6597562033f7c6a09dfb
Sha1	f15388fb52e60b669b4feb5beee3a68dbe445e49
Sha256	6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
Sha384	559ac3ec0b07297e746160134d9d45a086dcbc776c3e69b760cb1b25caa505b314cc92ae86fad0b85df8f6885466bf32
Sha512	0a0057da838775b7cb55f0b483d9d7acd893e5ce037289dc44d580cb8981ce07fd62e82182019d84f2400b7db8a54bf19da079711e6bfc101b4fb943f756e263
SSDeep	196608:MdrUvHqHxcp9ym3nltDUJViHxcp9ym31Hxcp9ym3WHxcp9ym37Hxcp9ym3eHxcpp:Mdru4GplpBGpnGpkGpFGpsGp
TLSH	4ED623116BF89678E0B62A35E876A0B1A1377D119D23D26E23247D1E3C71E80C9B3777

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 12 STICH kept: 1secondary ignored: 11

bin 10img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:dll>pe:dll

Shape pe:exe>pe:dll>pe:dll

3 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	FinalTry.exe
Full Name	FinalTry.exe
EntryPoint	System.Void Program::Main()
Scope Name	FinalTry.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	FinalTry
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	27
Main Method	System.Void Program::Main()
Main IL Instruction Count	124
Main IL	nop <null> newobj System.Void Program/<>c__DisplayClass1::.ctor() stloc.s V_4 nop <null> ldstr FinalTry started. call System.Void Program::Log(System.String) nop <null> ldloc.s V_4 call System.String System.IO.Path::GetTempPath() ldstr FinalTry_ call System.Guid System.Guid::NewGuid() stloc.s V_6 ldloca.s V_6 constrained. System.Guid callvirt System.String System.Object::ToString() call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stfld System.String Program/<>c__DisplayClass1::tempFolder ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr Temp folder: ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder ldstr Reader_en_install.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.0 <null> ldloc.s V_4 ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder ldstr ScreenConnect.ClientSetup.msi call System.String System.IO.Path::Combine(System.String,System.String) stfld System.String Program/<>c__DisplayClass1::msiFile ldstr Extracting Reader. call System.Void Program::Log(System.String) nop <null> ldstr Reader_en_install.exe ldloc.0 <null> call System.Void Program::ExtractResource(System.String,System.String) nop <null> ldstr Reader extracted. call System.Void Program::Log(System.String) nop <null> ldstr Extracting ScreenConnect MSI. call System.Void Program::Log(System.String) nop <null> ldstr ScreenConnect.ClientSetup.msi ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::msiFile call System.Void Program::ExtractResource(System.String,System.String) nop <null> ldstr MSI extracted. call System.Void Program::Log(System.String) nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.1 <null> ldloc.1 <null> ldloc.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> ldloc.1 <null> ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> ldloc.1 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.2 <null> ldloc.2 <null> ldnull <null> ceq <null> stloc.s V_7 ldloc.s V_7 brtrue.s IL_0131: ldloc.s V_4 nop <null> ldstr Reader started. PID: ldloc.2 <null> callvirt System.Int32 System.Diagnostics.Process::get_Id() stloc.s V_8 ldloca.s V_8 call System.String System.Int32::ToString() call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> nop <null> ldloc.s V_4 ldftn System.Void Program/<>c__DisplayClass1::<Main>b__0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) nop <null> ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() nop <null> ldstr Both installers started. call System.Void Program::Log(System.String) nop <null> nop <null> leave.s IL_017E: nop stloc.s V_5 nop <null> ldstr FATAL ERROR: ldloc.s V_5 callvirt System.String System.Object::ToString() call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> nop <null> leave.s IL_017E: nop nop <null> ret <null>
Module Name	FinalTry.exe
Full Name	FinalTry.exe
EntryPoint	System.Void Program::Main()
Scope Name	FinalTry.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	FinalTry
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	27
Main Method	System.Void Program::Main()
Main IL Instruction Count	124
Main IL	nop <null> newobj System.Void Program/<>c__DisplayClass1::.ctor() stloc.s V_4 nop <null> ldstr FinalTry started. call System.Void Program::Log(System.String) nop <null> ldloc.s V_4 call System.String System.IO.Path::GetTempPath() ldstr FinalTry_ call System.Guid System.Guid::NewGuid() stloc.s V_6 ldloca.s V_6 constrained. System.Guid callvirt System.String System.Object::ToString() call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stfld System.String Program/<>c__DisplayClass1::tempFolder ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr Temp folder: ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder ldstr Reader_en_install.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.0 <null> ldloc.s V_4 ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder ldstr ScreenConnect.ClientSetup.msi call System.String System.IO.Path::Combine(System.String,System.String) stfld System.String Program/<>c__DisplayClass1::msiFile ldstr Extracting Reader. call System.Void Program::Log(System.String) nop <null> ldstr Reader_en_install.exe ldloc.0 <null> call System.Void Program::ExtractResource(System.String,System.String) nop <null> ldstr Reader extracted. call System.Void Program::Log(System.String) nop <null> ldstr Extracting ScreenConnect MSI. call System.Void Program::Log(System.String) nop <null> ldstr ScreenConnect.ClientSetup.msi ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::msiFile call System.Void Program::ExtractResource(System.String,System.String) nop <null> ldstr MSI extracted. call System.Void Program::Log(System.String) nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.1 <null> ldloc.1 <null> ldloc.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> ldloc.1 <null> ldloc.s V_4 ldfld System.String Program/<>c__DisplayClass1::tempFolder callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> ldloc.1 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.2 <null> ldloc.2 <null> ldnull <null> ceq <null> stloc.s V_7 ldloc.s V_7 brtrue.s IL_0131: ldloc.s V_4 nop <null> ldstr Reader started. PID: ldloc.2 <null> callvirt System.Int32 System.Diagnostics.Process::get_Id() stloc.s V_8 ldloca.s V_8 call System.String System.Int32::ToString() call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> nop <null> ldloc.s V_4 ldftn System.Void Program/<>c__DisplayClass1::<Main>b__0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) nop <null> ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() nop <null> ldstr Both installers started. call System.Void Program::Log(System.String) nop <null> nop <null> leave.s IL_017E: nop stloc.s V_5 nop <null> ldstr FATAL ERROR: ldloc.s V_5 callvirt System.String System.Object::ToString() call System.String System.String::Concat(System.String,System.String) call System.Void Program::Log(System.String) nop <null> nop <null> leave.s IL_017E: nop nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.