Malicious
Malicious

45c73e7c87748b79dfccabdff67c9cb9

Share on LinkedIn
Print
PE Executable
MD5: 45c73e7c87748b79dfccabdff67c9cb9
Size: 423.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 45c73e7c87748b79dfccabdff67c9cb9
Sha1 011993caa02d0197d6bef075a8974ed029494b86
Sha256 f6a75594e7596047b08f288166e9e8e888e427923d3d50fdc3423d5979c92846
Sha384 56872b3fc79cfb75f1be23aa043243c43a09527b6f608f60e8f7a2018915f41c5421d0d683f57aa3723fa15c636024ba
Sha512 a927814d28d5397920b67ccf00c832347919b2f2e20fd7292cc92f895a8baea8bce302d9620d63761fef2f3511b7a3de23256d6bb75138c50981fc91f9e39560
SSDeep 6144:5N5YhzJ+dDLaYE0muv2T5XjxI/Gz1mKDb9aEhP9jLNsl6zjZvdn9HXGG7/riMBrw:5khzJ+zE9u6jxV3dtNeyJHX1/rI
TLSH 7194F1877AD40306C65A18B5C5E35E3313E6A9872B33DB553F19438A0F817E4EE5EB88
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
45c73e7c87748b79dfccabdff67c9cb9
Malicious
Overlay_adf8db95.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZwcaXnd331yO79jVpb.VeOn84eFIjbtA518Ft
l2kEmtuH1BbYmkjSTj.O3yhNU3RqX3EaOnU9Z
T5DMiIEjQm7D8x5KJt.YOsYUApod2A2e4ekgR
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_adf8db95.bin (1 bytes)
Module Name
Gbzzwnuarfa.exe
Full Name
Gbzzwnuarfa.exe
EntryPoint
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Scope Name
Gbzzwnuarfa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gbzzwnuarfa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0009: ldloc V_3
br IL_0032: nop
ret <null>
nop <null>
ldsfld Oy6H6XdTlUL96jsuk40 Oy6H6XdTlUL96jsuk40::xtDdUQivjL
call System.Byte[] Oy6H6XdTlUL96jsuk40::C6tdoMCHvq(Oy6H6XdTlUL96jsuk40)
stloc.s V_2
ldc.i4 2
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
br IL_0057: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00F8: ldloc.s V_2
ldloc V_0
ldc.i4 992
beq IL_0057: ldloc V_0
br IL_00D1: ldloc.s V_2
ldloc.s V_2
ldsfld TGOMQudmD2Dtytb1R46 TGOMQudmD2Dtytb1R46::uNWdNKU4iM
call System.Byte[] TGOMQudmD2Dtytb1R46::C6tdoMCHvq(System.Byte[],TGOMQudmD2Dtytb1R46)
stloc.s V_2
ldc.i4 12
br IL_0053: stloc V_0
br IL_013B: leave IL_0031
ldc.i4 3
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_686f73fb63a6416894e34a5aecf3b621
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 5
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldlen <null>
brtrue IL_0110: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_6e16d7569760409a85db08a1067ff701
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 7
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld hfsiW8d1KM4FNrBmoln hfsiW8d1KM4FNrBmoln::lUudKFOunc
call System.Byte[] hfsiW8d1KM4FNrBmoln::C6tdoMCHvq(System.Byte[],hfsiW8d1KM4FNrBmoln)
stloc.s V_2
ldc.i4 4
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld ROQf5ZdCucABGm7i3ho ROQf5ZdCucABGm7i3ho::Atfd77ko2P
call System.Void ROQf5ZdCucABGm7i3ho::C6tdoMCHvq(System.Byte[],ROQf5ZdCucABGm7i3ho)
ldc.i4 11
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_c99a4b57981a4e4f986e670c612637b4
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
leave IL_0031: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_1edc3ad53ddc4ce2a9b552e7104a69c1
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 5
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_016E: ldloc V_1
br IL_018E: leave IL_0031
leave IL_0031: ret
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_ea940008e65547bb808df505de409448
brfalse IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 7
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
ldsfld CBnbmHdJn1G0tJ16GWa CBnbmHdJn1G0tJ16GWa::f01dfQZKrh
call System.Void CBnbmHdJn1G0tJ16GWa::C6tdoMCHvq(CBnbmHdJn1G0tJ16GWa)
ldc.i4 6
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_073e98cee1624b49977492987935ed82
brtrue IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
Module Name
Gbzzwnuarfa.exe
Full Name
Gbzzwnuarfa.exe
EntryPoint
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Scope Name
Gbzzwnuarfa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gbzzwnuarfa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void sdrxcl8i9JfeGHky6Z.yPn1G9yfA3upq7cIZY::dkrZO5ble()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0009: ldloc V_3
br IL_0032: nop
ret <null>
nop <null>
ldsfld Oy6H6XdTlUL96jsuk40 Oy6H6XdTlUL96jsuk40::xtDdUQivjL
call System.Byte[] Oy6H6XdTlUL96jsuk40::C6tdoMCHvq(Oy6H6XdTlUL96jsuk40)
stloc.s V_2
ldc.i4 2
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
br IL_0057: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00F8: ldloc.s V_2
ldloc V_0
ldc.i4 992
beq IL_0057: ldloc V_0
br IL_00D1: ldloc.s V_2
ldloc.s V_2
ldsfld TGOMQudmD2Dtytb1R46 TGOMQudmD2Dtytb1R46::uNWdNKU4iM
call System.Byte[] TGOMQudmD2Dtytb1R46::C6tdoMCHvq(System.Byte[],TGOMQudmD2Dtytb1R46)
stloc.s V_2
ldc.i4 12
br IL_0053: stloc V_0
br IL_013B: leave IL_0031
ldc.i4 3
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_686f73fb63a6416894e34a5aecf3b621
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 5
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldlen <null>
brtrue IL_0110: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_6e16d7569760409a85db08a1067ff701
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 7
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld hfsiW8d1KM4FNrBmoln hfsiW8d1KM4FNrBmoln::lUudKFOunc
call System.Byte[] hfsiW8d1KM4FNrBmoln::C6tdoMCHvq(System.Byte[],hfsiW8d1KM4FNrBmoln)
stloc.s V_2
ldc.i4 4
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
ldloc.s V_2
ldsfld ROQf5ZdCucABGm7i3ho ROQf5ZdCucABGm7i3ho::Atfd77ko2P
call System.Void ROQf5ZdCucABGm7i3ho::C6tdoMCHvq(System.Byte[],ROQf5ZdCucABGm7i3ho)
ldc.i4 11
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_c99a4b57981a4e4f986e670c612637b4
brtrue IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_013B,IL_00AD,IL_0095,IL_0110,IL_00D1)
leave IL_0031: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_1edc3ad53ddc4ce2a9b552e7104a69c1
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 5
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_016E: ldloc V_1
br IL_018E: leave IL_0031
leave IL_0031: ret
ldc.i4 0
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_ea940008e65547bb808df505de409448
brfalse IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 7
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
ldsfld CBnbmHdJn1G0tJ16GWa CBnbmHdJn1G0tJ16GWa::f01dfQZKrh
call System.Void CBnbmHdJn1G0tJ16GWa::C6tdoMCHvq(CBnbmHdJn1G0tJ16GWa)
ldc.i4 6
ldsfld <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5} <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_58602b76beeb4ba794e61826d1a166b2
ldfld System.Int32 <Module>{9e6a277d-9097-43ac-9a7f-897c8b4d96c5}::m_073e98cee1624b49977492987935ed82
brtrue IL_000D: switch(IL_0031,IL_0032,IL_01B2)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_0032,IL_01B2)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙