Malicious
Malicious

3c4022820cadee20377aad52c77be4a7

PE Executable
MD5: 3c4022820cadee20377aad52c77be4a7
Size: 826.37 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
826.37 KB · 826,368 B
First seen
2026-08-13 08:46 · 2 months ago
Last seen
2026-08-13 08:46 · 2 months ago
Last analysis
2026-08-13 08:46 · 2 months ago
Hashes
MD5 3c4022820cadee20377aad52c77be4a7 Sha1 90fec864b2b96b17bd8b1f51f26094fe645f49e9 Sha256 2991abe51ce69b3b9737bfab89f6c46f993d80c0c05305dfd134171fb237ef37 Sha384 819ea1e42bb465eaf3b2c17136a368c0fcb6c0b781cb2b6e1438dd267aeaf41cf73071d54e0fc56c2434725716b7cfb3 Sha512 5ab4736d4c56ccb5289badfa64934c5d2ba1db07b49088ac6e444a249abf7dfb2a34a028e483c78e4bd9b0b4d14d887edbd01389e2654436a7270cea203ef678 SSDeep 12288:PuxmA22feGqxrvIRG8JNmNi2PTlcfgLLYxbdGEOAd9HuKGhpOUvu2BXbGv2Z3gy:DARHqOU8m3PTlPeJGEFFkBvjDZQ TLSH D605BF7A72928F20C2496377C1D7490187EA9A47B6ABFB0B31C513D61D033EEDE06697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE3c4022820cadee20377aad52c77be4a7
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BIN7S7Jf7VrVTFe0fTFmo.PCZOfWWyOuCOx3moiu
BINd3wOcnxOmDP6SAro5h.CaHEnGQ2dibWoGU900
BINqRXpNcfjJqnJ1RB0ZH.78qIL5hJmRMjK67lJT
BINO4FL2i6DILeAJ3c0W0.yB7qXAcFZpHljQVeke
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Xorhtdzjb.exe
Full Name
Xorhtdzjb.exe
EntryPoint
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Scope Name
Xorhtdzjb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xorhtdzjb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
nop <null>
ldsfld n4dgpOwf4IVDDqh2Lii n4dgpOwf4IVDDqh2Lii::vodwhlRWN8
call System.Byte[] n4dgpOwf4IVDDqh2Lii::SEqwPk0FJg(n4dgpOwf4IVDDqh2Lii)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_71591238a9df430e98de8a2c5406a478
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_01C0
ldc.i4 974794455
ldc.i4 2041834233
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3ce1fd22570f4eba87f4822e4d6ef93c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
ldc.i4 -990101396
ldc.i4 5
shl <null>
ldc.i4 -1479120994
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_214b954e360c41029af2739f457e974c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
newobj System.Void RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld PJqJDuwecbCPfUsG0Jn PJqJDuwecbCPfUsG0Jn::nVkwnEFvhD
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU PJqJDuwecbCPfUsG0Jn::SEqwPk0FJg(System.Object,System.Byte[],PJqJDuwecbCPfUsG0Jn)
ldsfld lgsFRuwdZjcHpkMTwJi lgsFRuwdZjcHpkMTwJi::mcOwaCesPl
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU lgsFRuwdZjcHpkMTwJi::SEqwPk0FJg(System.Object,lgsFRuwdZjcHpkMTwJi)
ldsfld eLdbnHw1FYuDu1peik5 eLdbnHw1FYuDu1peik5::X1EwlD62Uf
call System.Void eLdbnHw1FYuDu1peik5::SEqwPk0FJg(System.Object,eLdbnHw1FYuDu1peik5)
ldc.i4 0
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_afbee6bc0e204a4fb6576d6141f5c4a3
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 6
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3305a3713e7b45a0b05fc27ef942336d
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 0
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 5
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_b016dc85ff8c4af29770bf5862021e95
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
call System.Void UaH2Rywx6Voy1XIOLNw::SEqwPk0FJg(UaH2Rywx6Voy1XIOLNw)
ldc.i4 4
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_6df90df32cd744be9b4adfa50226823d
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
Module Name
Xorhtdzjb.exe
Full Name
Xorhtdzjb.exe
EntryPoint
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Scope Name
Xorhtdzjb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xorhtdzjb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
nop <null>
ldsfld n4dgpOwf4IVDDqh2Lii n4dgpOwf4IVDDqh2Lii::vodwhlRWN8
call System.Byte[] n4dgpOwf4IVDDqh2Lii::SEqwPk0FJg(n4dgpOwf4IVDDqh2Lii)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_71591238a9df430e98de8a2c5406a478
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_01C0
ldc.i4 974794455
ldc.i4 2041834233
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3ce1fd22570f4eba87f4822e4d6ef93c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
ldc.i4 -990101396
ldc.i4 5
shl <null>
ldc.i4 -1479120994
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_214b954e360c41029af2739f457e974c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
newobj System.Void RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld PJqJDuwecbCPfUsG0Jn PJqJDuwecbCPfUsG0Jn::nVkwnEFvhD
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU PJqJDuwecbCPfUsG0Jn::SEqwPk0FJg(System.Object,System.Byte[],PJqJDuwecbCPfUsG0Jn)
ldsfld lgsFRuwdZjcHpkMTwJi lgsFRuwdZjcHpkMTwJi::mcOwaCesPl
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU lgsFRuwdZjcHpkMTwJi::SEqwPk0FJg(System.Object,lgsFRuwdZjcHpkMTwJi)
ldsfld eLdbnHw1FYuDu1peik5 eLdbnHw1FYuDu1peik5::X1EwlD62Uf
call System.Void eLdbnHw1FYuDu1peik5::SEqwPk0FJg(System.Object,eLdbnHw1FYuDu1peik5)
ldc.i4 0
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_afbee6bc0e204a4fb6576d6141f5c4a3
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 6
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3305a3713e7b45a0b05fc27ef942336d
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 0
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 5
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_b016dc85ff8c4af29770bf5862021e95
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
call System.Void UaH2Rywx6Voy1XIOLNw::SEqwPk0FJg(UaH2Rywx6Voy1XIOLNw)
ldc.i4 4
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_6df90df32cd744be9b4adfa50226823d
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
1 malicious · 7 files
EXE3c4022820cadee20377aad52c77be4a7
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙