Malicious
Malicious

3dd5a58c5659db8cebfb0a2f4c456c18

PE Executable
MD5: 3dd5a58c5659db8cebfb0a2f4c456c18
Size: 436.22 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
436.22 KB · 436,224 B
First seen
2026-08-13 06:46 · 2 months ago
Last seen
2026-08-13 06:46 · 2 months ago
Last analysis
2026-08-13 06:50 · 2 months ago
Hashes
MD5 3dd5a58c5659db8cebfb0a2f4c456c18 Sha1 47913082a952666c15d6e761286f0e98ccfd32d2 Sha256 b6ec4bc228289231f84fbc7330402668cf9d79eaec0f5179148a15ca937c0c7b Sha384 d9cb2de37ee1f62b4238be3edbff8f6592d6f269aaf6e6503909d03d7f01fc416b374389f7bf8a39af354a60b70caa47 Sha512 62db777b50950b40ab5c556c2cb5cd66fd5b0420ebbee86f152da4d08720ad935af65413aa9f35dd519b9ade822387fd5c168343a41b138d7ba206973a4772d6 SSDeep 6144:MstbZ3mqaSz1fpiTcxmfohB18EE+2b12APFik25l0Re9X3:dplxfATcZiMAAk25l0m TLSH 9E943A5737664F50C2895B33C0CB961083A6AA86B9E3F30FB24413A65D533FED94B693
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE3dd5a58c5659db8cebfb0a2f4c456c18
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BIN765B5uqu4Y1ZtoP4Jb.Y9icZTyZqP2iyfPwFV
BIN1e5KgVTm9clyYc6LMY.lbMoLgGQbgpte2Smrc
BINoWxQiCamZx6N6aB5OE.VNeHADShrBxxuTvWBA
BINp7rwyJERmM5u9Hum3N.MF14nRhYfgMl5mKxth
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Iqbjtaewv.exe
Full Name
Iqbjtaewv.exe
EntryPoint
System.Void Uj0Q7V7YBlFkLaK8vu.ubVE1hY5VYgYlUlTpb::p4lvbMO1v()
Scope Name
Iqbjtaewv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Iqbjtaewv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Uj0Q7V7YBlFkLaK8vu.ubVE1hY5VYgYlUlTpb::p4lvbMO1v()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01B2: ret
nop <null>
ldsfld fmJP79Y16wK9cnqGR3n fmJP79Y16wK9cnqGR3n::U3AYV0hMLD
call System.Byte[] fmJP79Y16wK9cnqGR3n::eYyYCkfycm(fmJP79Y16wK9cnqGR3n)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_5763831b083b4c5ab791270687639470
brtrue IL_0076: switch(IL_0112,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0112,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0112: leave IL_01B2
ldc.i4 401005690
ldc.i4 6
shl <null>
ldc.i4 -1171517838
xor <null>
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f6a206eb54244af497f2bcc34853521a
xor <null>
ldsfld Lld0SJYis8IWlKeW8Tp Lld0SJYis8IWlKeW8Tp::inXYfXGnM5
call System.String Lld0SJYis8IWlKeW8Tp::eYyYCkfycm(System.Int32,Lld0SJYis8IWlKeW8Tp)
ldc.i4 -1005832430
neg <null>
ldc.i4 772711399
xor <null>
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_90b1a0e9b57b4a33b473506a1415bdcb
xor <null>
ldsfld Lld0SJYis8IWlKeW8Tp Lld0SJYis8IWlKeW8Tp::inXYfXGnM5
call System.String Lld0SJYis8IWlKeW8Tp::eYyYCkfycm(System.Int32,Lld0SJYis8IWlKeW8Tp)
newobj System.Void vJwHwUdhFEWkNoaWWg.RY1LgiwPsWOscbhOoS::.ctor(System.String,System.String)
newobj System.Void rG2fochaygAZHVVN6Wi.D2ZparhywSQqxdnCBX6::.ctor(vJwHwUdhFEWkNoaWWg.RY1LgiwPsWOscbhOoS)
ldloc.s V_0
ldsfld EojFjDYUGYonoq2PboG EojFjDYUGYonoq2PboG::eZNYzaQASF
call System.Void EojFjDYUGYonoq2PboG::eYyYCkfycm(System.Object,System.Byte[],EojFjDYUGYonoq2PboG)
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f6a206eb54244af497f2bcc34853521a
brtrue IL_0076: switch(IL_0112,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0112,IL_0096)
leave IL_01B2: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_26f06926ceb54bc99720b2b449c31d55
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 1
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0145: ldloc V_3
br IL_0165: leave IL_01B2
leave IL_01B2: ret
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_ab66df25c5814efcb13b4c61dddbf401
brtrue IL_0014: switch(IL_01B2,IL_0038,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01B2,IL_0038,IL_0189)
ldsfld yvIckeY8harSy3sRQR1 yvIckeY8harSy3sRQR1::KTKYcOltpN
call System.Void yvIckeY8harSy3sRQR1::eYyYCkfycm(yvIckeY8harSy3sRQR1)
ldc.i4 1
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_7c5e1d7a2fcd464bb8daa224502bc3a7
brtrue IL_0014: switch(IL_01B2,IL_0038,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01B2,IL_0038,IL_0189)
ret <null>
Module Name
Iqbjtaewv.exe
Full Name
Iqbjtaewv.exe
EntryPoint
System.Void Uj0Q7V7YBlFkLaK8vu.ubVE1hY5VYgYlUlTpb::p4lvbMO1v()
Scope Name
Iqbjtaewv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Iqbjtaewv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Uj0Q7V7YBlFkLaK8vu.ubVE1hY5VYgYlUlTpb::p4lvbMO1v()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01B2: ret
nop <null>
ldsfld fmJP79Y16wK9cnqGR3n fmJP79Y16wK9cnqGR3n::U3AYV0hMLD
call System.Byte[] fmJP79Y16wK9cnqGR3n::eYyYCkfycm(fmJP79Y16wK9cnqGR3n)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_5763831b083b4c5ab791270687639470
brtrue IL_0076: switch(IL_0112,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0112,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0112: leave IL_01B2
ldc.i4 401005690
ldc.i4 6
shl <null>
ldc.i4 -1171517838
xor <null>
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f6a206eb54244af497f2bcc34853521a
xor <null>
ldsfld Lld0SJYis8IWlKeW8Tp Lld0SJYis8IWlKeW8Tp::inXYfXGnM5
call System.String Lld0SJYis8IWlKeW8Tp::eYyYCkfycm(System.Int32,Lld0SJYis8IWlKeW8Tp)
ldc.i4 -1005832430
neg <null>
ldc.i4 772711399
xor <null>
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_90b1a0e9b57b4a33b473506a1415bdcb
xor <null>
ldsfld Lld0SJYis8IWlKeW8Tp Lld0SJYis8IWlKeW8Tp::inXYfXGnM5
call System.String Lld0SJYis8IWlKeW8Tp::eYyYCkfycm(System.Int32,Lld0SJYis8IWlKeW8Tp)
newobj System.Void vJwHwUdhFEWkNoaWWg.RY1LgiwPsWOscbhOoS::.ctor(System.String,System.String)
newobj System.Void rG2fochaygAZHVVN6Wi.D2ZparhywSQqxdnCBX6::.ctor(vJwHwUdhFEWkNoaWWg.RY1LgiwPsWOscbhOoS)
ldloc.s V_0
ldsfld EojFjDYUGYonoq2PboG EojFjDYUGYonoq2PboG::eZNYzaQASF
call System.Void EojFjDYUGYonoq2PboG::eYyYCkfycm(System.Object,System.Byte[],EojFjDYUGYonoq2PboG)
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f6a206eb54244af497f2bcc34853521a
brtrue IL_0076: switch(IL_0112,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0112,IL_0096)
leave IL_01B2: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_26f06926ceb54bc99720b2b449c31d55
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 1
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0145: ldloc V_3
br IL_0165: leave IL_01B2
leave IL_01B2: ret
ldc.i4 0
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_ab66df25c5814efcb13b4c61dddbf401
brtrue IL_0014: switch(IL_01B2,IL_0038,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01B2,IL_0038,IL_0189)
ldsfld yvIckeY8harSy3sRQR1 yvIckeY8harSy3sRQR1::KTKYcOltpN
call System.Void yvIckeY8harSy3sRQR1::eYyYCkfycm(yvIckeY8harSy3sRQR1)
ldc.i4 1
ldsfld <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11} <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_f5910e935dc245e19f5f84ba5f5eacce
ldfld System.Int32 <Module>{5c7cc8b7-b100-4ba2-8b78-b17f1d4aed11}::m_7c5e1d7a2fcd464bb8daa224502bc3a7
brtrue IL_0014: switch(IL_01B2,IL_0038,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01B2,IL_0038,IL_0189)
ret <null>
1 malicious · 7 files
EXE3dd5a58c5659db8cebfb0a2f4c456c18
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙