4329d2f807792f8a4c75c542bd96c9da

PE Executable

MD5: 4329d2f807792f8a4c75c542bd96c9da

Size: 1.27 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	4329d2f807792f8a4c75c542bd96c9da
Sha1	a3b1b182fa1abe7a8d190673700cb6aaf9281517
Sha256	82928d420d3aefdbfa3440e45f662caf2b67c05c4acbcc11cb17caaf1a8e1fd5
Sha384	5ac21ec961675edbf1a5093a9bfdd9b30ab523033716c41272a9420485509f39d73bf9c60e91aed4efcfcf9440ed3b94
Sha512	d56065e018360325a1beea915d0019aa40a2971f24bdd4488a911f644ef1c48c43e84eeee603a68155423b5fe170c48036d78ef9b1224ddc8f7819b891e106a0
SSDeep	24576:RWr2vFTGScxAVu/Suleasb9eSx5l8z7G/7OW2Yt8BO4d2YvRoDd8DnS5C9f+Ce:wrCTG/Jlpw9eSx56+/7L2C8BO82YCDdn
TLSH	9E45CFA42BEF815EE7E16D7D2ED0E93CF9F9C3902C7B0A0249A11A5CF65AD9C08D1057

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 4secondary ignored: 4

bin 3img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>arc:zip>scr:ps1~T1027~T1059.005>scr:vbs~T1059.005

Shape pe:exe>arc:zip>scr:ps1>scr:vbs

malicious 4 nodes

Path pe:exe>arc:zip>scr:ps1~T1027~T1059.001

Shape pe:exe>arc:zip>scr:ps1

malicious 3 nodes

Name	Value
Module Name	Setup-Netwitch by Lacflex.exe
Full Name	Setup-Netwitch by Lacflex.exe
EntryPoint	System.Int32 SetupLauncher::Main()
Scope Name	Setup-Netwitch by Lacflex.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Setup-Netwitch by Lacflex
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	12
Main Method	System.Int32 SetupLauncher::Main()
Main IL Instruction Count	216
Main IL	nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_BaseDirectory() stloc.0 <null> ldnull <null> stloc.1 <null> ldnull <null> stloc.2 <null> ldnull <null> stloc.3 <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr NetwitchSupport.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 ldloc.s V_4 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue IL_00CC: nop nop <null> call System.String System.IO.Path::GetTempPath() ldstr NetwitchByLacflexSetup- call System.Guid System.Guid::NewGuid() stloc.s V_13 ldloca.s V_13 ldstr N call System.String System.Guid::ToString(System.String) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> ldloc.2 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.2 <null> ldstr support.zip call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 ldloc.s V_4 stloc.s V_14 ldloc.s V_5 call System.IO.FileStream System.IO.File::Create(System.String) stloc.s V_6 nop <null> ldloc.s V_4 ldloc.s V_6 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) nop <null> nop <null> leave.s IL_009E: nop ldloc.s V_6 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_009D: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> leave.s IL_00B5: nop ldloc.s V_14 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_00B4: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> ldloc.s V_5 ldloc.2 <null> call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String) nop <null> ldloc.s V_5 call System.Void System.IO.File::Delete(System.String) nop <null> ldloc.2 <null> stloc.1 <null> nop <null> br.s IL_00EA: ldloc.1 nop <null> ldloc.0 <null> ldstr .netwitch call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> ldloc.1 <null> call System.Boolean System.IO.Directory::Exists(System.String) stloc.s V_12 ldloc.s V_12 brtrue.s IL_00E9: nop nop <null> ldloc.0 <null> stloc.1 <null> nop <null> nop <null> ldloc.1 <null> ldstr Setup-Netwitch by Lacflex.ps1 call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) stloc.s V_12 ldloc.s V_12 brtrue.s IL_011E: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() nop <null> ldstr Setup file was not found. Please extract the ZIP file before running setup. ldstr Netwitch by Lacflex Setup ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_11 leave IL_01F2: nop newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_9 ldloc.s V_9 ldstr powershell.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> ldloc.s V_9 ldstr -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File " ldloc.3 <null> ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) nop <null> ldloc.s V_9 ldloc.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> ldloc.s V_9 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) nop <null> ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) nop <null> ldloc.s V_9 stloc.s V_7 ldloc.s V_7 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 nop <null> ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() nop <null> ldloc.s V_8 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() stloc.s V_11 leave.s IL_01F2: nop ldloc.s V_8 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_01A2: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> stloc.s V_10 nop <null> ldloc.s V_10 callvirt System.String System.Exception::get_Message() ldstr Netwitch by Lacflex Setup ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_11 leave.s IL_01F2: nop nop <null> ldloc.2 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue.s IL_01D4: ldc.i4.1 ldloc.2 <null> call System.Boolean System.IO.Directory::Exists(System.String) ldc.i4.0 <null> ceq <null> br.s IL_01D5: nop ldc.i4.1 <null> nop <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_01F0: nop nop <null> nop <null> ldloc.2 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) nop <null> nop <null> leave.s IL_01EE: nop pop <null> nop <null> nop <null> leave.s IL_01EE: nop nop <null> nop <null> nop <null> endfinally <null> nop <null> ldloc.s V_11 ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	Setup-Netwitch by Lacflex.exe
Full Name	Setup-Netwitch by Lacflex.exe
EntryPoint	System.Int32 SetupLauncher::Main()
Scope Name	Setup-Netwitch by Lacflex.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Setup-Netwitch by Lacflex
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	12
Main Method	System.Int32 SetupLauncher::Main()
Main IL Instruction Count	216
Main IL	nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_BaseDirectory() stloc.0 <null> ldnull <null> stloc.1 <null> ldnull <null> stloc.2 <null> ldnull <null> stloc.3 <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr NetwitchSupport.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 ldloc.s V_4 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue IL_00CC: nop nop <null> call System.String System.IO.Path::GetTempPath() ldstr NetwitchByLacflexSetup- call System.Guid System.Guid::NewGuid() stloc.s V_13 ldloca.s V_13 ldstr N call System.String System.Guid::ToString(System.String) call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> ldloc.2 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.2 <null> ldstr support.zip call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 ldloc.s V_4 stloc.s V_14 ldloc.s V_5 call System.IO.FileStream System.IO.File::Create(System.String) stloc.s V_6 nop <null> ldloc.s V_4 ldloc.s V_6 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) nop <null> nop <null> leave.s IL_009E: nop ldloc.s V_6 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_009D: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> leave.s IL_00B5: nop ldloc.s V_14 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_00B4: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> nop <null> ldloc.s V_5 ldloc.2 <null> call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String) nop <null> ldloc.s V_5 call System.Void System.IO.File::Delete(System.String) nop <null> ldloc.2 <null> stloc.1 <null> nop <null> br.s IL_00EA: ldloc.1 nop <null> ldloc.0 <null> ldstr .netwitch call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> ldloc.1 <null> call System.Boolean System.IO.Directory::Exists(System.String) stloc.s V_12 ldloc.s V_12 brtrue.s IL_00E9: nop nop <null> ldloc.0 <null> stloc.1 <null> nop <null> nop <null> ldloc.1 <null> ldstr Setup-Netwitch by Lacflex.ps1 call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) stloc.s V_12 ldloc.s V_12 brtrue.s IL_011E: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() nop <null> ldstr Setup file was not found. Please extract the ZIP file before running setup. ldstr Netwitch by Lacflex Setup ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_11 leave IL_01F2: nop newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_9 ldloc.s V_9 ldstr powershell.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> ldloc.s V_9 ldstr -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -STA -File " ldloc.3 <null> ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) nop <null> ldloc.s V_9 ldloc.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> ldloc.s V_9 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) nop <null> ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) nop <null> ldloc.s V_9 stloc.s V_7 ldloc.s V_7 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 nop <null> ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() nop <null> ldloc.s V_8 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() stloc.s V_11 leave.s IL_01F2: nop ldloc.s V_8 ldnull <null> ceq <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_01A2: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> stloc.s V_10 nop <null> ldloc.s V_10 callvirt System.String System.Exception::get_Message() ldstr Netwitch by Lacflex Setup ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_11 leave.s IL_01F2: nop nop <null> ldloc.2 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue.s IL_01D4: ldc.i4.1 ldloc.2 <null> call System.Boolean System.IO.Directory::Exists(System.String) ldc.i4.0 <null> ceq <null> br.s IL_01D5: nop ldc.i4.1 <null> nop <null> stloc.s V_12 ldloc.s V_12 brtrue.s IL_01F0: nop nop <null> nop <null> ldloc.2 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) nop <null> nop <null> leave.s IL_01EE: nop pop <null> nop <null> nop <null> leave.s IL_01EE: nop nop <null> nop <null> nop <null> endfinally <null> nop <null> ldloc.s V_11 ret <null>

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

param(huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

4329d2f807792f8a4c75c542bd96c9da › .Net Resources › NetwitchSupport.zip › Netwitch by Lacflex-Task.vbs

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

4329d2f807792f8a4c75c542bd96c9da › .Net Resources › NetwitchSupport.zip › Netwitch by Lacflex.vbs

Deobfuscated PowerShell UNKNWOWNmalicious

param(huhuhuhuhuhuhuhuhuhuhu

4329d2f807792f8a4c75c542bd96c9da › .Net Resources › NetwitchSupport.zip › Netwitch by Lacflex.ps1 › [Deobfuscated PS]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.