Malicious
Malicious

459fc584ab7ae85e2082641214bf4c2e

Share on LinkedIn
Print
PE Executable
MD5: 459fc584ab7ae85e2082641214bf4c2e
Size: 418.82 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 459fc584ab7ae85e2082641214bf4c2e
Sha1 debd6163946a0d454f2d5b48914d86b016f2f62b
Sha256 84f424ddaecbdddba7844ef3a44b12e1b449a313a012384767733bdd8c1ead4d
Sha384 5276cfa0cd36f7837eb5900e2ef099dffd264ae22b50c03b6e30955d56187e0489a407ef638c7fcddbecf93b77db8081
Sha512 b46d6f9b1e6c5d8cfc23191f01ce985656a04f6ac76a3ee229cdcbe3aa79743048c258db0ea36c09c68eb969ea1376c330b1d672529ac4b32c45314afede9057
SSDeep 3072:MqTq+VjiTO4+s/uvD/ffB4YUUMakXq8TZueBqgag0aqBOA7OBkfuDPNS98+z9eDI:ZTZRi/dSDB1rMB4FzCN6MUsbQZ0LyxC
TLSH 04943A1737914E22C28E5337D0DB4500D3E696833AABE72F3588239A19467FEDA0B757
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
459fc584ab7ae85e2082641214bf4c2e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
SS2rTeuDt4PUjVJogo.acY2wDNDVru7eOWdjB
r0ogl3ijcG6LGlbANG.onGAn7JJwr9qh2Dikn
ILUR35BtAsM2VY0Qq7.dXXlRBLplNoSoXeE50
RaxmYTS1dlH9vgBOjA.5F19CuUSaKGIEafoUW
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Dddbpoxok.exe
Full Name
Dddbpoxok.exe
EntryPoint
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Scope Name
Dddbpoxok.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dddbpoxok
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld MueNiPfWbcykT6nIAX6 MueNiPfWbcykT6nIAX6::ofafbaJ4YS
call System.Byte[] MueNiPfWbcykT6nIAX6::v4ff7UKHS0(MueNiPfWbcykT6nIAX6)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_4c9f59b3b5eb4c77b687bae1599628e1
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -2073422230
ldc.i4 -2073422230
ldc.i4 -1094978399
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_85b7e1251bf6433a91e9cda290127a35
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
ldc.i4 -2067545134
ldc.i4 -1281085699
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c69f4b08d8f4e9a983ffdc33183e0d8
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
newobj System.Void y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ::.ctor(System.String,System.String)
newobj System.Void wZEGscSFZ8PelFXxDAJ.BRSZdmSTtqdulBg25CV::.ctor(y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ)
ldloc.s V_2
ldsfld T2Z0l3frK217kuW7pVI T2Z0l3frK217kuW7pVI::BPCfgpsNaV
call System.Void T2Z0l3frK217kuW7pVI::v4ff7UKHS0(System.Object,System.Byte[],T2Z0l3frK217kuW7pVI)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_572535e941b74946aff55c92c47960ad
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_3182870835b748c2a10c0c537bdbabec
brtrue IL_0143: switch(IL_015F)
pop <null>
ldc.i4 2
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c30a3e03c244e68a1416fb4cfc202dc
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld Pi6tBWfYt2Jjbc0BkHc Pi6tBWfYt2Jjbc0BkHc::ydTfHfe9rY
call System.Void Pi6tBWfYt2Jjbc0BkHc::v4ff7UKHS0(Pi6tBWfYt2Jjbc0BkHc)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_6f47e4c1ad2b45c7a8a664b901f29dd3
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
Module Name
Dddbpoxok.exe
Full Name
Dddbpoxok.exe
EntryPoint
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Scope Name
Dddbpoxok.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Dddbpoxok
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void qhmXIx85hoCkLd9Q7X.kkVVwNfbdf9I8xIfm3::xJ7dx925B()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld MueNiPfWbcykT6nIAX6 MueNiPfWbcykT6nIAX6::ofafbaJ4YS
call System.Byte[] MueNiPfWbcykT6nIAX6::v4ff7UKHS0(MueNiPfWbcykT6nIAX6)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_4c9f59b3b5eb4c77b687bae1599628e1
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 7
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -2073422230
ldc.i4 -2073422230
ldc.i4 -1094978399
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_85b7e1251bf6433a91e9cda290127a35
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
ldc.i4 -2067545134
ldc.i4 -1281085699
xor <null>
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c69f4b08d8f4e9a983ffdc33183e0d8
xor <null>
ldsfld JhXu0ZfjYVZbIkwvV4H JhXu0ZfjYVZbIkwvV4H::i4XfhyogVk
call System.String JhXu0ZfjYVZbIkwvV4H::v4ff7UKHS0(System.Int32,JhXu0ZfjYVZbIkwvV4H)
newobj System.Void y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ::.ctor(System.String,System.String)
newobj System.Void wZEGscSFZ8PelFXxDAJ.BRSZdmSTtqdulBg25CV::.ctor(y1bfYJyUp5UY5IdyOp.e73dK6xQt2KmKF38AQ)
ldloc.s V_2
ldsfld T2Z0l3frK217kuW7pVI T2Z0l3frK217kuW7pVI::BPCfgpsNaV
call System.Void T2Z0l3frK217kuW7pVI::v4ff7UKHS0(System.Object,System.Byte[],T2Z0l3frK217kuW7pVI)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_572535e941b74946aff55c92c47960ad
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_3182870835b748c2a10c0c537bdbabec
brtrue IL_0143: switch(IL_015F)
pop <null>
ldc.i4 2
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_7c30a3e03c244e68a1416fb4cfc202dc
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld Pi6tBWfYt2Jjbc0BkHc Pi6tBWfYt2Jjbc0BkHc::ydTfHfe9rY
call System.Void Pi6tBWfYt2Jjbc0BkHc::v4ff7UKHS0(Pi6tBWfYt2Jjbc0BkHc)
ldc.i4 0
ldsfld <Module>{c3472101-f61b-4121-a3d2-76c21748892b} <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_bae662cd616342a2b4f9f297933ca09a
ldfld System.Int32 <Module>{c3472101-f61b-4121-a3d2-76c21748892b}::m_6f47e4c1ad2b45c7a8a664b901f29dd3
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙