Malicious
Malicious

3c4022820cadee20377aad52c77be4a7

PE Executable
MD5: 3c4022820cadee20377aad52c77be4a7
Size: 826.37 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 3c4022820cadee20377aad52c77be4a7
Sha1 90fec864b2b96b17bd8b1f51f26094fe645f49e9
Sha256 2991abe51ce69b3b9737bfab89f6c46f993d80c0c05305dfd134171fb237ef37
Sha384 819ea1e42bb465eaf3b2c17136a368c0fcb6c0b781cb2b6e1438dd267aeaf41cf73071d54e0fc56c2434725716b7cfb3
Sha512 5ab4736d4c56ccb5289badfa64934c5d2ba1db07b49088ac6e444a249abf7dfb2a34a028e483c78e4bd9b0b4d14d887edbd01389e2654436a7270cea203ef678
SSDeep 12288:PuxmA22feGqxrvIRG8JNmNi2PTlcfgLLYxbdGEOAd9HuKGhpOUvu2BXbGv2Z3gy:DARHqOU8m3PTlPeJGEFFkBvjDZQ
TLSH D605BF7A72928F20C2496377C1D7490187EA9A47B6ABFB0B31C513D61D033EEDE06697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3c4022820cadee20377aad52c77be4a7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
7S7Jf7VrVTFe0fTFmo.PCZOfWWyOuCOx3moiu
d3wOcnxOmDP6SAro5h.CaHEnGQ2dibWoGU900
qRXpNcfjJqnJ1RB0ZH.78qIL5hJmRMjK67lJT
O4FL2i6DILeAJ3c0W0.yB7qXAcFZpHljQVeke
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Xorhtdzjb.exe
Full Name
Xorhtdzjb.exe
EntryPoint
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Scope Name
Xorhtdzjb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xorhtdzjb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
nop <null>
ldsfld n4dgpOwf4IVDDqh2Lii n4dgpOwf4IVDDqh2Lii::vodwhlRWN8
call System.Byte[] n4dgpOwf4IVDDqh2Lii::SEqwPk0FJg(n4dgpOwf4IVDDqh2Lii)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_71591238a9df430e98de8a2c5406a478
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_01C0
ldc.i4 974794455
ldc.i4 2041834233
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3ce1fd22570f4eba87f4822e4d6ef93c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
ldc.i4 -990101396
ldc.i4 5
shl <null>
ldc.i4 -1479120994
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_214b954e360c41029af2739f457e974c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
newobj System.Void RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld PJqJDuwecbCPfUsG0Jn PJqJDuwecbCPfUsG0Jn::nVkwnEFvhD
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU PJqJDuwecbCPfUsG0Jn::SEqwPk0FJg(System.Object,System.Byte[],PJqJDuwecbCPfUsG0Jn)
ldsfld lgsFRuwdZjcHpkMTwJi lgsFRuwdZjcHpkMTwJi::mcOwaCesPl
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU lgsFRuwdZjcHpkMTwJi::SEqwPk0FJg(System.Object,lgsFRuwdZjcHpkMTwJi)
ldsfld eLdbnHw1FYuDu1peik5 eLdbnHw1FYuDu1peik5::X1EwlD62Uf
call System.Void eLdbnHw1FYuDu1peik5::SEqwPk0FJg(System.Object,eLdbnHw1FYuDu1peik5)
ldc.i4 0
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_afbee6bc0e204a4fb6576d6141f5c4a3
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 6
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3305a3713e7b45a0b05fc27ef942336d
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 0
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 5
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_b016dc85ff8c4af29770bf5862021e95
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
call System.Void UaH2Rywx6Voy1XIOLNw::SEqwPk0FJg(UaH2Rywx6Voy1XIOLNw)
ldc.i4 4
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_6df90df32cd744be9b4adfa50226823d
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
Module Name
Xorhtdzjb.exe
Full Name
Xorhtdzjb.exe
EntryPoint
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Scope Name
Xorhtdzjb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xorhtdzjb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void m9V9nYE4sWuPhDHHdq.lTH3tiwvrdpM4w3PgR::qWSe73EVg()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
nop <null>
ldsfld n4dgpOwf4IVDDqh2Lii n4dgpOwf4IVDDqh2Lii::vodwhlRWN8
call System.Byte[] n4dgpOwf4IVDDqh2Lii::SEqwPk0FJg(n4dgpOwf4IVDDqh2Lii)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_71591238a9df430e98de8a2c5406a478
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_01C0
ldc.i4 974794455
ldc.i4 2041834233
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3ce1fd22570f4eba87f4822e4d6ef93c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
ldc.i4 -990101396
ldc.i4 5
shl <null>
ldc.i4 -1479120994
xor <null>
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_214b954e360c41029af2739f457e974c
xor <null>
ldsfld k2kWQcwwbRHjw3eOmS5 k2kWQcwwbRHjw3eOmS5::qCCwEQHnHM
call System.String k2kWQcwwbRHjw3eOmS5::SEqwPk0FJg(System.Int32,k2kWQcwwbRHjw3eOmS5)
newobj System.Void RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld PJqJDuwecbCPfUsG0Jn PJqJDuwecbCPfUsG0Jn::nVkwnEFvhD
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU PJqJDuwecbCPfUsG0Jn::SEqwPk0FJg(System.Object,System.Byte[],PJqJDuwecbCPfUsG0Jn)
ldsfld lgsFRuwdZjcHpkMTwJi lgsFRuwdZjcHpkMTwJi::mcOwaCesPl
call RZIYaE6N4QrWh8XMBO9.lKEyBW6PhZAK1wwnTiU lgsFRuwdZjcHpkMTwJi::SEqwPk0FJg(System.Object,lgsFRuwdZjcHpkMTwJi)
ldsfld eLdbnHw1FYuDu1peik5 eLdbnHw1FYuDu1peik5::X1EwlD62Uf
call System.Void eLdbnHw1FYuDu1peik5::SEqwPk0FJg(System.Object,eLdbnHw1FYuDu1peik5)
ldc.i4 0
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_afbee6bc0e204a4fb6576d6141f5c4a3
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 6
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_3305a3713e7b45a0b05fc27ef942336d
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 0
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 5
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_b016dc85ff8c4af29770bf5862021e95
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld UaH2Rywx6Voy1XIOLNw UaH2Rywx6Voy1XIOLNw::wuEwQxlLv6
call System.Void UaH2Rywx6Voy1XIOLNw::SEqwPk0FJg(UaH2Rywx6Voy1XIOLNw)
ldc.i4 4
ldsfld <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb} <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_82ba27d8e5544eb2b23cb4408916c076
ldfld System.Int32 <Module>{752cd7a8-55b2-4723-8daa-e462debc0dfb}::m_6df90df32cd744be9b4adfa50226823d
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
3c4022820cadee20377aad52c77be4a7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
7S7Jf7VrVTFe0fTFmo.PCZOfWWyOuCOx3moiu
d3wOcnxOmDP6SAro5h.CaHEnGQ2dibWoGU900
qRXpNcfjJqnJ1RB0ZH.78qIL5hJmRMjK67lJT
O4FL2i6DILeAJ3c0W0.yB7qXAcFZpHljQVeke
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙