Malicious
Malicious

45c73e7c87748b79dfccabdff67c9cb9

PE Executable
MD5: 45c73e7c87748b79dfccabdff67c9cb9
Size: 423.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 45c73e7c87748b79dfccabdff67c9cb9
Sha1 011993caa02d0197d6bef075a8974ed029494b86
Sha256 f6a75594e7596047b08f288166e9e8e888e427923d3d50fdc3423d5979c92846
Sha384 56872b3fc79cfb75f1be23aa043243c43a09527b6f608f60e8f7a2018915f41c5421d0d683f57aa3723fa15c636024ba
Sha512 a927814d28d5397920b67ccf00c832347919b2f2e20fd7292cc92f895a8baea8bce302d9620d63761fef2f3511b7a3de23256d6bb75138c50981fc91f9e39560
SSDeep 6144:5N5YhzJ+dDLaYE0muv2T5XjxI/Gz1mKDb9aEhP9jLNsl6zjZvdn9HXGG7/riMBrw:5khzJ+zE9u6jxV3dtNeyJHX1/rI
TLSH 7194F1877AD40306C65A18B5C5E35E3313E6A9872B33DB553F19438A0F817E4EE5EB88
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
45c73e7c87748b79dfccabdff67c9cb9
Malicious
Overlay_adf8db95.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZwcaXnd331yO79jVpb.VeOn84eFIjbtA518Ft
l2kEmtuH1BbYmkjSTj.O3yhNU3RqX3EaOnU9Z
T5DMiIEjQm7D8x5KJt.YOsYUApod2A2e4ekgR
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_adf8db95.bin (1 bytes)
Module Name
Gbzzwnuarfa.exe
Full Name
Gbzzwnuarfa.exe
EntryPoint
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Scope Name
Gbzzwnuarfa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gbzzwnuarfa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0009: ldloc V_3
br IL_0032: nop
ret <null>
nop <null>
ldsfld Oy6H6XdTlUL96jsuk40 Oy6H6XdTlUL96jsuk40::xtDdUQivjL
call System.Byte[] Oy6H6XdTlUL96jsuk40::C6tdoMCHvq(Oy6H6XdTlUL96jsuk40)
stloc.s V_2
ldc.i4 2
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
br IL_0057: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00F8: ldloc.s V_2
ldloc V_0
ldc.i4 992
beq IL_0057: ldloc V_0
br IL_00D1: ldloc.s V_2
ldloc.s V_2
ldsfld TGOMQudmD2Dtytb1R46 TGOMQudmD2Dtytb1R46::uNWdNKU4iM
call System.Byte[] TGOMQudmD2Dtytb1R46::C6tdoMCHvq(System.Byte[],TGOMQudmD2Dtytb1R46)
stloc.s V_2
ldc.i4 12
br IL_0053: stloc V_0
br IL_013B: leave IL_0031
ldc.i4 3
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_686f73fb63a6416894e34a5aecf3b621
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 5
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldlen <null>
brtrue IL_0110: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_6e16d7569760409a85db08a1067ff701
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 7
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld hfsiW8d1KM4FNrBmoln hfsiW8d1KM4FNrBmoln::lUudKFOunc
call System.Byte[] hfsiW8d1KM4FNrBmoln::C6tdoMCHvq(System.Byte[],hfsiW8d1KM4FNrBmoln)
stloc.s V_2
ldc.i4 4
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld ROQf5ZdCucABGm7i3ho ROQf5ZdCucABGm7i3ho::Atfd77ko2P
call System.Void ROQf5ZdCucABGm7i3ho::C6tdoMCHvq(System.Byte[],ROQf5ZdCucABGm7i3ho)
ldc.i4 11
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_c99a4b57981a4e4f986e670c612637b4
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
leave IL_0031: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_1edc3ad53ddc4ce2a9b552e7104a69c1
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 5
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_016E: ldloc V_1
br IL_018E: leave IL_0031
leave IL_0031: ret
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_ea940008e65547bb808df505de409448
brfalse IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 7
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
ldsfld CBnbmHdJn1G0tJ16GWa CBnbmHdJn1G0tJ16GWa::f01dfQZKrh
call System.Void CBnbmHdJn1G0tJ16GWa::C6tdoMCHvq(CBnbmHdJn1G0tJ16GWa)
ldc.i4 6
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_073e98cee1624b49977492987935ed82
brtrue IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
Module Name
Gbzzwnuarfa.exe
Full Name
Gbzzwnuarfa.exe
EntryPoint
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Scope Name
Gbzzwnuarfa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gbzzwnuarfa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0009: ldloc V_3
br IL_0032: nop
ret <null>
nop <null>
ldsfld Oy6H6XdTlUL96jsuk40 Oy6H6XdTlUL96jsuk40::xtDdUQivjL
call System.Byte[] Oy6H6XdTlUL96jsuk40::C6tdoMCHvq(Oy6H6XdTlUL96jsuk40)
stloc.s V_2
ldc.i4 2
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
br IL_0057: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00F8: ldloc.s V_2
ldloc V_0
ldc.i4 992
beq IL_0057: ldloc V_0
br IL_00D1: ldloc.s V_2
ldloc.s V_2
ldsfld TGOMQudmD2Dtytb1R46 TGOMQudmD2Dtytb1R46::uNWdNKU4iM
call System.Byte[] TGOMQudmD2Dtytb1R46::C6tdoMCHvq(System.Byte[],TGOMQudmD2Dtytb1R46)
stloc.s V_2
ldc.i4 12
br IL_0053: stloc V_0
br IL_013B: leave IL_0031
ldc.i4 3
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_686f73fb63a6416894e34a5aecf3b621
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 5
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldlen <null>
brtrue IL_0110: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_6e16d7569760409a85db08a1067ff701
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 7
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld hfsiW8d1KM4FNrBmoln hfsiW8d1KM4FNrBmoln::lUudKFOunc
call System.Byte[] hfsiW8d1KM4FNrBmoln::C6tdoMCHvq(System.Byte[],hfsiW8d1KM4FNrBmoln)
stloc.s V_2
ldc.i4 4
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld ROQf5ZdCucABGm7i3ho ROQf5ZdCucABGm7i3ho::Atfd77ko2P
call System.Void ROQf5ZdCucABGm7i3ho::C6tdoMCHvq(System.Byte[],ROQf5ZdCucABGm7i3ho)
ldc.i4 11
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_c99a4b57981a4e4f986e670c612637b4
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
leave IL_0031: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_1edc3ad53ddc4ce2a9b552e7104a69c1
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 5
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_016E: ldloc V_1
br IL_018E: leave IL_0031
leave IL_0031: ret
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_ea940008e65547bb808df505de409448
brfalse IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 7
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
ldsfld CBnbmHdJn1G0tJ16GWa CBnbmHdJn1G0tJ16GWa::f01dfQZKrh
call System.Void CBnbmHdJn1G0tJ16GWa::C6tdoMCHvq(CBnbmHdJn1G0tJ16GWa)
ldc.i4 6
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_073e98cee1624b49977492987935ed82
brtrue IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
45c73e7c87748b79dfccabdff67c9cb9
Malicious
Overlay_adf8db95.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZwcaXnd331yO79jVpb.VeOn84eFIjbtA518Ft
l2kEmtuH1BbYmkjSTj.O3yhNU3RqX3EaOnU9Z
T5DMiIEjQm7D8x5KJt.YOsYUApod2A2e4ekgR
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙