Malicious
Malicious

44cec351503f80dc302647d713adbd33

PE Executable
MD5: 44cec351503f80dc302647d713adbd33
Size: 830.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 44cec351503f80dc302647d713adbd33
Sha1 4ae58412280a4492b434435e802bdf619576680c
Sha256 ca33eeabb9860584f49ff9a881de1fc6a218813d7bfbcbeae842fcb579ea482c
Sha384 41454ee0025c02b31d54461fdc35a7521163e6b30e03a7c1019b71d026af2bf06dddcc7683fb78d1e90a5ff9669c0942
Sha512 57ae710bc875d0653ca10b06be2cfda0fb7909244d9aad251190bbfa8315f49b2e3de91a26991b864384b8c384a4747bea7ed6b4efdcd5bf96bfa206e71424ec
SSDeep 12288:8HwH8P8lRuw06cogW2bpfDO8OzPDMmLr0YXUa5Rw7oA0Z9ZTU15:bffINrY8OrDMUrHUl7MZH4
TLSH E505BF3A76998F25C1465377C1C7490083EA96473BABFB0F368503D629037EEDA0A797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
44cec351503f80dc302647d713adbd33
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hamAwyooabu8MlUM0C.VXPf08GooMsxw54RCO
DKvxMwAbYVBntYWReL.MVMgXwB0ueo3vDkHis
McK4CWExj1Bwy0lQyF.9cMqwbkaNTPrfA0gjv
0uQoNkcAulWmIle9ni.W52qokrtD5UQdbcK0q
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Zfjwnl.exe
Full Name
Zfjwnl.exe
EntryPoint
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Scope Name
Zfjwnl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zfjwnl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: nop
ldsfld ehZLM8pE7Ap5eqBR7h2 ehZLM8pE7Ap5eqBR7h2::uH2pkypsDV
call System.Void ehZLM8pE7Ap5eqBR7h2::S2QpD9asbE(ehZLM8pE7Ap5eqBR7h2)
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6d1c28a0222a4d9d8c402a4af670e994
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
nop <null>
ldsfld GhHTY1pA1d3N9Ajf329 GhHTY1pA1d3N9Ajf329::hGHpBdR5pU
call System.Byte[] GhHTY1pA1d3N9Ajf329::S2QpD9asbE(GhHTY1pA1d3N9Ajf329)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_77fac586ca7041bebcf2cfe8afbc1db6
brfalse IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0144: leave IL_01BB
ldc.i4 633733859
ldc.i4 857907904
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_3e08a96194cc46e1887896a1201fa059
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
ldc.i4 23948603
not <null>
ldc.i4 -1509576656
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f16c0d0e685a468898530483fc702d6b
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
newobj System.Void SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld yCRQyQpm5htUIMJPPt3 yCRQyQpm5htUIMJPPt3::IOYpKTI9SL
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb yCRQyQpm5htUIMJPPt3::S2QpD9asbE(System.Object,System.Byte[],yCRQyQpm5htUIMJPPt3)
ldsfld CTSJsGp4awcoor82ewA CTSJsGp4awcoor82ewA::A1xpYtbyqd
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb CTSJsGp4awcoor82ewA::S2QpD9asbE(System.Object,CTSJsGp4awcoor82ewA)
ldsfld rYcqZZpCA1OutVNC2OE rYcqZZpCA1OutVNC2OE::wJjp3vJo6f
call System.Void rYcqZZpCA1OutVNC2OE::S2QpD9asbE(System.Object,rYcqZZpCA1OutVNC2OE)
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_9b600927447f490fb0ba6b60b0735221
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f9cfa09b59b94f28b3b8709982686f79
brtrue IL_017B: switch(IL_0197)
pop <null>
ldc.i4 0
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6a0e6f746ca84528b77cf470aac8705f
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
ret <null>
Module Name
Zfjwnl.exe
Full Name
Zfjwnl.exe
EntryPoint
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Scope Name
Zfjwnl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zfjwnl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: nop
ldsfld ehZLM8pE7Ap5eqBR7h2 ehZLM8pE7Ap5eqBR7h2::uH2pkypsDV
call System.Void ehZLM8pE7Ap5eqBR7h2::S2QpD9asbE(ehZLM8pE7Ap5eqBR7h2)
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6d1c28a0222a4d9d8c402a4af670e994
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
nop <null>
ldsfld GhHTY1pA1d3N9Ajf329 GhHTY1pA1d3N9Ajf329::hGHpBdR5pU
call System.Byte[] GhHTY1pA1d3N9Ajf329::S2QpD9asbE(GhHTY1pA1d3N9Ajf329)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_77fac586ca7041bebcf2cfe8afbc1db6
brfalse IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0144: leave IL_01BB
ldc.i4 633733859
ldc.i4 857907904
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_3e08a96194cc46e1887896a1201fa059
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
ldc.i4 23948603
not <null>
ldc.i4 -1509576656
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f16c0d0e685a468898530483fc702d6b
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
newobj System.Void SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld yCRQyQpm5htUIMJPPt3 yCRQyQpm5htUIMJPPt3::IOYpKTI9SL
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb yCRQyQpm5htUIMJPPt3::S2QpD9asbE(System.Object,System.Byte[],yCRQyQpm5htUIMJPPt3)
ldsfld CTSJsGp4awcoor82ewA CTSJsGp4awcoor82ewA::A1xpYtbyqd
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb CTSJsGp4awcoor82ewA::S2QpD9asbE(System.Object,CTSJsGp4awcoor82ewA)
ldsfld rYcqZZpCA1OutVNC2OE rYcqZZpCA1OutVNC2OE::wJjp3vJo6f
call System.Void rYcqZZpCA1OutVNC2OE::S2QpD9asbE(System.Object,rYcqZZpCA1OutVNC2OE)
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_9b600927447f490fb0ba6b60b0735221
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f9cfa09b59b94f28b3b8709982686f79
brtrue IL_017B: switch(IL_0197)
pop <null>
ldc.i4 0
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6a0e6f746ca84528b77cf470aac8705f
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
ret <null>
44cec351503f80dc302647d713adbd33
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hamAwyooabu8MlUM0C.VXPf08GooMsxw54RCO
DKvxMwAbYVBntYWReL.MVMgXwB0ueo3vDkHis
McK4CWExj1Bwy0lQyF.9cMqwbkaNTPrfA0gjv
0uQoNkcAulWmIle9ni.W52qokrtD5UQdbcK0q
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙