Malicious
Malicious

4168b8f7086eca0cbbd9ccb27e3b4d63

PE Executable
MD5: 4168b8f7086eca0cbbd9ccb27e3b4d63
Size: 568.32 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4168b8f7086eca0cbbd9ccb27e3b4d63
Sha1 c3f17de8a1e92cc80e270e62b444274e022fd6ce
Sha256 01be4a4dbee15e0f07ddf8be467da3d683cc57f245cbba93a9263f56c1249a42
Sha384 4cb236ccb3548759ce0831523c5db44621003c6b8ba0e4dac0a143f5d1e96c7ae66d8b059fc6f738f692d75056217c02
Sha512 e634a8675ae9efaa0a16c04a16ef227f750abc8d93965d0658e04edc422eecb6263119ec9e1fd6db04dfd5ea2bdd4a4118aad7e14b465090a025c258db41f875
SSDeep 12288:rNT0xIb+JSAyVNs6kAtjSmAE6e7v3eu8ie:rt5ZVi+D6e/8i
TLSH 92C47B5B36524E60C6890B33C1DB960083A29686FAA7F34FB28403A55D533FEDA477D3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4168b8f7086eca0cbbd9ccb27e3b4d63
Malicious
.Net Resources
U6njYaRqEvybC4lPro.ORi6wwD2hiUEgx3Wmi
7bPxybXXeevUnxOslj.lTrjkHTfEKylPmx4Sq
SZtdevlEHecQkVGQCI.QKdrWJG0XMmy7mEtwX
MsMkT5LJwj7RKm1GYk.Qr5O6MH3ey6L2Ne3Bp
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Yvosaadqoe.exe
Full Name
Yvosaadqoe.exe
EntryPoint
System.Void EHfwIRfCntIuvEqIMP.L6PJh4b9DZ5dNcpjKG::ELYKu1tmZ()
Scope Name
Yvosaadqoe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yvosaadqoe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EHfwIRfCntIuvEqIMP.L6PJh4b9DZ5dNcpjKG::ELYKu1tmZ()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_01AC: ret
ldsfld pkQia6b8bwmYqAfhHfs pkQia6b8bwmYqAfhHfs::QQabooqrlI
call System.Void pkQia6b8bwmYqAfhHfs::O2xbAHZmv1(pkQia6b8bwmYqAfhHfs)
ldc.i4 0
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_61cc7252213f4bc0a0e4035422c71a6b
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01AC)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AC)
nop <null>
ldsfld DH5NMybnF775gPvh2Hw DH5NMybnF775gPvh2Hw::nYgbsTLrru
call System.Byte[] DH5NMybnF775gPvh2Hw::O2xbAHZmv1(DH5NMybnF775gPvh2Hw)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_f437d4e2fdf64d9b8646a80fb63adf85
brfalse IL_009F: switch(IL_0135,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0135,IL_00BF)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_0135: leave IL_01AC
ldc.i4 71574249
ldc.i4 638993029
xor <null>
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_4ae4b7d026a44c059527124eb0018740
xor <null>
ldsfld sXN8Dtb5kBfLDHaqjE7 sXN8Dtb5kBfLDHaqjE7::QtRbJXq3TI
call System.String sXN8Dtb5kBfLDHaqjE7::O2xbAHZmv1(System.Int32,sXN8Dtb5kBfLDHaqjE7)
ldc.i4 -639688943
neg <null>
ldc.i4 1890856466
xor <null>
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_7532314cbe2f4f88997f62211ce04282
xor <null>
ldsfld sXN8Dtb5kBfLDHaqjE7 sXN8Dtb5kBfLDHaqjE7::QtRbJXq3TI
call System.String sXN8Dtb5kBfLDHaqjE7::O2xbAHZmv1(System.Int32,sXN8Dtb5kBfLDHaqjE7)
newobj System.Void csyEQSPxtd7rL8DgZo.pKahBAqxD1XBW226kd::.ctor(System.String,System.String)
newobj System.Void NHjavuHRUTkWg2EdQRx.hK9NNwHTe3sFyL2pygB::.ctor(csyEQSPxtd7rL8DgZo.pKahBAqxD1XBW226kd)
ldloc.s V_1
ldsfld vAVTp1bxCp7woxpvH7E vAVTp1bxCp7woxpvH7E::H9KbzZlT0g
call System.Void vAVTp1bxCp7woxpvH7E::O2xbAHZmv1(System.Object,System.Byte[],vAVTp1bxCp7woxpvH7E)
ldc.i4 2
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_852d5a179c654e5b899aed6b5f904bf2
brtrue IL_009F: switch(IL_0135,IL_00BF)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_0135,IL_00BF)
leave IL_01AC: ret
pop <null>
ldc.i4 3
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_747252fece614cca87216a2116e73194
brtrue IL_016C: switch(IL_0188)
pop <null>
ldc.i4 0
br IL_016C: switch(IL_0188)
br IL_0168: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0168: ldloc V_3
br IL_0188: leave IL_01AC
leave IL_01AC: ret
ldc.i4 2
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_7532314cbe2f4f88997f62211ce04282
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01AC)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AC)
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
Yvosaadqoe.exe
Full Name
Yvosaadqoe.exe
EntryPoint
System.Void EHfwIRfCntIuvEqIMP.L6PJh4b9DZ5dNcpjKG::ELYKu1tmZ()
Scope Name
Yvosaadqoe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yvosaadqoe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void EHfwIRfCntIuvEqIMP.L6PJh4b9DZ5dNcpjKG::ELYKu1tmZ()
Main IL Instruction Count
95
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_01AC: ret
ldsfld pkQia6b8bwmYqAfhHfs pkQia6b8bwmYqAfhHfs::QQabooqrlI
call System.Void pkQia6b8bwmYqAfhHfs::O2xbAHZmv1(pkQia6b8bwmYqAfhHfs)
ldc.i4 0
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_61cc7252213f4bc0a0e4035422c71a6b
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01AC)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AC)
nop <null>
ldsfld DH5NMybnF775gPvh2Hw DH5NMybnF775gPvh2Hw::nYgbsTLrru
call System.Byte[] DH5NMybnF775gPvh2Hw::O2xbAHZmv1(DH5NMybnF775gPvh2Hw)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_f437d4e2fdf64d9b8646a80fb63adf85
brfalse IL_009F: switch(IL_0135,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0135,IL_00BF)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_0135: leave IL_01AC
ldc.i4 71574249
ldc.i4 638993029
xor <null>
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_4ae4b7d026a44c059527124eb0018740
xor <null>
ldsfld sXN8Dtb5kBfLDHaqjE7 sXN8Dtb5kBfLDHaqjE7::QtRbJXq3TI
call System.String sXN8Dtb5kBfLDHaqjE7::O2xbAHZmv1(System.Int32,sXN8Dtb5kBfLDHaqjE7)
ldc.i4 -639688943
neg <null>
ldc.i4 1890856466
xor <null>
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_7532314cbe2f4f88997f62211ce04282
xor <null>
ldsfld sXN8Dtb5kBfLDHaqjE7 sXN8Dtb5kBfLDHaqjE7::QtRbJXq3TI
call System.String sXN8Dtb5kBfLDHaqjE7::O2xbAHZmv1(System.Int32,sXN8Dtb5kBfLDHaqjE7)
newobj System.Void csyEQSPxtd7rL8DgZo.pKahBAqxD1XBW226kd::.ctor(System.String,System.String)
newobj System.Void NHjavuHRUTkWg2EdQRx.hK9NNwHTe3sFyL2pygB::.ctor(csyEQSPxtd7rL8DgZo.pKahBAqxD1XBW226kd)
ldloc.s V_1
ldsfld vAVTp1bxCp7woxpvH7E vAVTp1bxCp7woxpvH7E::H9KbzZlT0g
call System.Void vAVTp1bxCp7woxpvH7E::O2xbAHZmv1(System.Object,System.Byte[],vAVTp1bxCp7woxpvH7E)
ldc.i4 2
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_852d5a179c654e5b899aed6b5f904bf2
brtrue IL_009F: switch(IL_0135,IL_00BF)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_0135,IL_00BF)
leave IL_01AC: ret
pop <null>
ldc.i4 3
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_747252fece614cca87216a2116e73194
brtrue IL_016C: switch(IL_0188)
pop <null>
ldc.i4 0
br IL_016C: switch(IL_0188)
br IL_0168: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0168: ldloc V_3
br IL_0188: leave IL_01AC
leave IL_01AC: ret
ldc.i4 2
ldsfld <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99} <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_ec9a0467b1b74538a29e1c5650cd6c1a
ldfld System.Int32 <Module>{785de16f-66bb-4491-bd34-9a0be8a4dc99}::m_7532314cbe2f4f88997f62211ce04282
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01AC)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AC)
ret <null>
4168b8f7086eca0cbbd9ccb27e3b4d63
Malicious
.Net Resources
U6njYaRqEvybC4lPro.ORi6wwD2hiUEgx3Wmi
7bPxybXXeevUnxOslj.lTrjkHTfEKylPmx4Sq
SZtdevlEHecQkVGQCI.QKdrWJG0XMmy7mEtwX
MsMkT5LJwj7RKm1GYk.Qr5O6MH3ey6L2Ne3Bp
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙