Malicious
Malicious

44cec351503f80dc302647d713adbd33

Share on LinkedIn
Print
PE Executable
MD5: 44cec351503f80dc302647d713adbd33
Size: 830.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 44cec351503f80dc302647d713adbd33
Sha1 4ae58412280a4492b434435e802bdf619576680c
Sha256 ca33eeabb9860584f49ff9a881de1fc6a218813d7bfbcbeae842fcb579ea482c
Sha384 41454ee0025c02b31d54461fdc35a7521163e6b30e03a7c1019b71d026af2bf06dddcc7683fb78d1e90a5ff9669c0942
Sha512 57ae710bc875d0653ca10b06be2cfda0fb7909244d9aad251190bbfa8315f49b2e3de91a26991b864384b8c384a4747bea7ed6b4efdcd5bf96bfa206e71424ec
SSDeep 12288:8HwH8P8lRuw06cogW2bpfDO8OzPDMmLr0YXUa5Rw7oA0Z9ZTU15:bffINrY8OrDMUrHUl7MZH4
TLSH E505BF3A76998F25C1465377C1C7490083EA96473BABFB0F368503D629037EEDA0A797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
44cec351503f80dc302647d713adbd33
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hamAwyooabu8MlUM0C.VXPf08GooMsxw54RCO
DKvxMwAbYVBntYWReL.MVMgXwB0ueo3vDkHis
McK4CWExj1Bwy0lQyF.9cMqwbkaNTPrfA0gjv
0uQoNkcAulWmIle9ni.W52qokrtD5UQdbcK0q
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Zfjwnl.exe
Full Name
Zfjwnl.exe
EntryPoint
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Scope Name
Zfjwnl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zfjwnl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: nop
ldsfld ehZLM8pE7Ap5eqBR7h2 ehZLM8pE7Ap5eqBR7h2::uH2pkypsDV
call System.Void ehZLM8pE7Ap5eqBR7h2::S2QpD9asbE(ehZLM8pE7Ap5eqBR7h2)
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6d1c28a0222a4d9d8c402a4af670e994
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
nop <null>
ldsfld GhHTY1pA1d3N9Ajf329 GhHTY1pA1d3N9Ajf329::hGHpBdR5pU
call System.Byte[] GhHTY1pA1d3N9Ajf329::S2QpD9asbE(GhHTY1pA1d3N9Ajf329)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_77fac586ca7041bebcf2cfe8afbc1db6
brfalse IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0144: leave IL_01BB
ldc.i4 633733859
ldc.i4 857907904
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_3e08a96194cc46e1887896a1201fa059
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
ldc.i4 23948603
not <null>
ldc.i4 -1509576656
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f16c0d0e685a468898530483fc702d6b
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
newobj System.Void SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld yCRQyQpm5htUIMJPPt3 yCRQyQpm5htUIMJPPt3::IOYpKTI9SL
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb yCRQyQpm5htUIMJPPt3::S2QpD9asbE(System.Object,System.Byte[],yCRQyQpm5htUIMJPPt3)
ldsfld CTSJsGp4awcoor82ewA CTSJsGp4awcoor82ewA::A1xpYtbyqd
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb CTSJsGp4awcoor82ewA::S2QpD9asbE(System.Object,CTSJsGp4awcoor82ewA)
ldsfld rYcqZZpCA1OutVNC2OE rYcqZZpCA1OutVNC2OE::wJjp3vJo6f
call System.Void rYcqZZpCA1OutVNC2OE::S2QpD9asbE(System.Object,rYcqZZpCA1OutVNC2OE)
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_9b600927447f490fb0ba6b60b0735221
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f9cfa09b59b94f28b3b8709982686f79
brtrue IL_017B: switch(IL_0197)
pop <null>
ldc.i4 0
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6a0e6f746ca84528b77cf470aac8705f
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
ret <null>
Module Name
Zfjwnl.exe
Full Name
Zfjwnl.exe
EntryPoint
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Scope Name
Zfjwnl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zfjwnl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TPCEEBWyQ2c4VySDNN.Xd4LqIpD9UakhSGx2I::aMfm9tRWK()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: nop
ldsfld ehZLM8pE7Ap5eqBR7h2 ehZLM8pE7Ap5eqBR7h2::uH2pkypsDV
call System.Void ehZLM8pE7Ap5eqBR7h2::S2QpD9asbE(ehZLM8pE7Ap5eqBR7h2)
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6d1c28a0222a4d9d8c402a4af670e994
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
nop <null>
ldsfld GhHTY1pA1d3N9Ajf329 GhHTY1pA1d3N9Ajf329::hGHpBdR5pU
call System.Byte[] GhHTY1pA1d3N9Ajf329::S2QpD9asbE(GhHTY1pA1d3N9Ajf329)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_77fac586ca7041bebcf2cfe8afbc1db6
brfalse IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0144: leave IL_01BB
ldc.i4 633733859
ldc.i4 857907904
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_3e08a96194cc46e1887896a1201fa059
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
ldc.i4 23948603
not <null>
ldc.i4 -1509576656
xor <null>
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f16c0d0e685a468898530483fc702d6b
xor <null>
ldsfld L3UDIEpp9V9DtmqePic L3UDIEpp9V9DtmqePic::KBcpWQXeuV
call System.String L3UDIEpp9V9DtmqePic::S2QpD9asbE(System.Int32,L3UDIEpp9V9DtmqePic)
newobj System.Void SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld yCRQyQpm5htUIMJPPt3 yCRQyQpm5htUIMJPPt3::IOYpKTI9SL
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb yCRQyQpm5htUIMJPPt3::S2QpD9asbE(System.Object,System.Byte[],yCRQyQpm5htUIMJPPt3)
ldsfld CTSJsGp4awcoor82ewA CTSJsGp4awcoor82ewA::A1xpYtbyqd
call SNJDPocP3RQmKcsggQa.EH49APcDA9phLO6ICSb CTSJsGp4awcoor82ewA::S2QpD9asbE(System.Object,CTSJsGp4awcoor82ewA)
ldsfld rYcqZZpCA1OutVNC2OE rYcqZZpCA1OutVNC2OE::wJjp3vJo6f
call System.Void rYcqZZpCA1OutVNC2OE::S2QpD9asbE(System.Object,rYcqZZpCA1OutVNC2OE)
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_9b600927447f490fb0ba6b60b0735221
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_f9cfa09b59b94f28b3b8709982686f79
brtrue IL_017B: switch(IL_0197)
pop <null>
ldc.i4 0
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 7
ldsfld <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1} <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_ce102d2b1f9140c88db850d3a4a173f1
ldfld System.Int32 <Module>{5abd81cc-52a9-48bb-a8b8-708d3bda90e1}::m_6a0e6f746ca84528b77cf470aac8705f
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01BB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01BB)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙