Malicious
Malicious

459fc584ab7ae85e2082641214bf4c2e

PE Executable
MD5: 459fc584ab7ae85e2082641214bf4c2e
Size: 418.82 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 459fc584ab7ae85e2082641214bf4c2e
Sha1 debd6163946a0d454f2d5b48914d86b016f2f62b
Sha256 84f424ddaecbdddba7844ef3a44b12e1b449a313a012384767733bdd8c1ead4d
Sha384 5276cfa0cd36f7837eb5900e2ef099dffd264ae22b50c03b6e30955d56187e0489a407ef638c7fcddbecf93b77db8081
Sha512 b46d6f9b1e6c5d8cfc23191f01ce985656a04f6ac76a3ee229cdcbe3aa79743048c258db0ea36c09c68eb969ea1376c330b1d672529ac4b32c45314afede9057
SSDeep 3072:MqTq+VjiTO4+s/uvD/ffB4YUUMakXq8TZueBqgag0aqBOA7OBkfuDPNS98+z9eDI:ZTZRi/dSDB1rMB4FzCN6MUsbQZ0LyxC
TLSH 04943A1737914E22C28E5337D0DB4500D3E696833AABE72F3588239A19467FEDA0B757
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
459fc584ab7ae85e2082641214bf4c2e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SS2rTeuDt4PUjVJogo.acY2wDNDVru7eOWdjB
r0ogl3ijcG6LGlbANG.onGAn7JJwr9qh2Dikn
ILUR35BtAsM2VY0Qq7.dXXlRBLplNoSoXeE50
RaxmYTS1dlH9vgBOjA.5F19CuUSaKGIEafoUW
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Dddbpoxok.exe
Full Name
Dddbpoxok.exe
EntryPoint
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Scope Name
Dddbpoxok.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dddbpoxok
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld MueNiPfWbcykT6nIAX6 MueNiPfWbcykT6nIAX6::ofafbaJ4YS
call System.Byte[] MueNiPfWbcykT6nIAX6::v4ff7UKHS0(MueNiPfWbcykT6nIAX6)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_4c9f59b3b5eb4c77b687bae1599628e1
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -2073422230
ldc.i4 -2073422230
ldc.i4 -1094978399
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_85b7e1251bf6433a91e9cda290127a35
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
ldc.i4 -2067545134
ldc.i4 -1281085699
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c69f4b08d8f4e9a983ffdc33183e0d8
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
newobj System.Void y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ::.ctor(System.String,System.String)
newobj System.Void wZEGscSFZ8PelFXxDAJ.BRSZdmSTtqdulBg25CV::.ctor(y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ)
ldloc.s V_2
ldsfld T2Z0l3frK217kuW7pVI T2Z0l3frK217kuW7pVI::BPCfgpsNaV
call System.Void T2Z0l3frK217kuW7pVI::v4ff7UKHS0(System.Object,System.Byte[],T2Z0l3frK217kuW7pVI)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_572535e941b74946aff55c92c47960ad
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_3182870835b748c2a10c0c537bdbabec
brtrue IL_0143: switch(IL_015F)
pop <null>
ldc.i4 2
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c30a3e03c244e68a1416fb4cfc202dc
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld Pi6tBWfYt2Jjbc0BkHc Pi6tBWfYt2Jjbc0BkHc::ydTfHfe9rY
call System.Void Pi6tBWfYt2Jjbc0BkHc::v4ff7UKHS0(Pi6tBWfYt2Jjbc0BkHc)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_6f47e4c1ad2b45c7a8a664b901f29dd3
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
Module Name
Dddbpoxok.exe
Full Name
Dddbpoxok.exe
EntryPoint
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Scope Name
Dddbpoxok.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dddbpoxok
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld MueNiPfWbcykT6nIAX6 MueNiPfWbcykT6nIAX6::ofafbaJ4YS
call System.Byte[] MueNiPfWbcykT6nIAX6::v4ff7UKHS0(MueNiPfWbcykT6nIAX6)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_4c9f59b3b5eb4c77b687bae1599628e1
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -2073422230
ldc.i4 -2073422230
ldc.i4 -1094978399
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_85b7e1251bf6433a91e9cda290127a35
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
ldc.i4 -2067545134
ldc.i4 -1281085699
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c69f4b08d8f4e9a983ffdc33183e0d8
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
newobj System.Void y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ::.ctor(System.String,System.String)
newobj System.Void wZEGscSFZ8PelFXxDAJ.BRSZdmSTtqdulBg25CV::.ctor(y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ)
ldloc.s V_2
ldsfld T2Z0l3frK217kuW7pVI T2Z0l3frK217kuW7pVI::BPCfgpsNaV
call System.Void T2Z0l3frK217kuW7pVI::v4ff7UKHS0(System.Object,System.Byte[],T2Z0l3frK217kuW7pVI)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_572535e941b74946aff55c92c47960ad
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_3182870835b748c2a10c0c537bdbabec
brtrue IL_0143: switch(IL_015F)
pop <null>
ldc.i4 2
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c30a3e03c244e68a1416fb4cfc202dc
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld Pi6tBWfYt2Jjbc0BkHc Pi6tBWfYt2Jjbc0BkHc::ydTfHfe9rY
call System.Void Pi6tBWfYt2Jjbc0BkHc::v4ff7UKHS0(Pi6tBWfYt2Jjbc0BkHc)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_6f47e4c1ad2b45c7a8a664b901f29dd3
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
459fc584ab7ae85e2082641214bf4c2e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SS2rTeuDt4PUjVJogo.acY2wDNDVru7eOWdjB
r0ogl3ijcG6LGlbANG.onGAn7JJwr9qh2Dikn
ILUR35BtAsM2VY0Qq7.dXXlRBLplNoSoXeE50
RaxmYTS1dlH9vgBOjA.5F19CuUSaKGIEafoUW
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙