Suspicious
Suspect

4abdbf5a0ba2aa1b307d46c5af5577cd

PE Executable
MD5: 4abdbf5a0ba2aa1b307d46c5af5577cd
Size: 1.35 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4abdbf5a0ba2aa1b307d46c5af5577cd
Sha1 5f8c5d8fe9f1edc49032e4ff00467904a42346b4
Sha256 4963fdb1090f9ccb52dd989e2a90b86d92e9d72612eb9fc3a99b18bccd7aec1f
Sha384 395d4b4bbfe56ab238bc6af39cd0956f984444229449aef36fa2ba42df916333b8811c1f816dbffbd6975f065a1d1b22
Sha512 8269752d209f389ada632ed0d7b2a26a6077bb08f3b41a895eceb9589aeb68e8bc86a33209fd749755ee5fed466775862b40ea61e81a1e32f693fa8036032d62
SSDeep 12288:ABhpcYL2jIh+dyHE9p+cXWfYQM1XZRrNXl9qAjg7OwXyF9lwHedIychCyVnBFlt+:ohNL2MhgqlgQMFpl9xeAHIychBvlM
TLSH 4055AE0A16D55DA7E4A99F3867B8037846FCBD274920E3BA65047FE88E31706A3C1773
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4abdbf5a0ba2aa1b307d46c5af5577cd
.Net Resources
Tafinobix.kbfida.levi
Wc1i7beA.Resources.resources
a221d2ab1aeb0a.Resources.resources
7cbd3e3e0
[NBF]root.Data
7cbd3e3e1
[NBF]root.Data
7cbd3e3e2
[NBF]root.Data
7cbd3e3e3
[NBF]root.Data
7cbd3e3e4
[NBF]root.Data
7cbd3e3e5
[NBF]root.Data
7cbd3e3e6
[NBF]root.Data
7cbd3e3e7
[NBF]root.Data
7cbd3e3e8
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
Wc1i7beA
Full Name
Wc1i7beA
EntryPoint
System.Void Wc1i7beA.Pz1t2Zqic::Bfo8yi4JK()
Scope Name
Wc1i7beA
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wc1i7beA
Assembly Version
22.19.2.282
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1399
Main Method
System.Void Wc1i7beA.Pz1t2Zqic::Bfo8yi4JK()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object Wc1i7beA.RenoLedger.Cdy43n/yMx43.gH_6te4T::3xjMoXk1R4wrxF(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Wc1i7beA.Pz1t2Zqic::iWe53jzD(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void Wc1i7beA.Pz1t2Zqic::Se6ta4bC9Ttid(System.Object[],System.Int32)
nop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
Wc1i7beA
Full Name
Wc1i7beA
EntryPoint
System.Void Wc1i7beA.Pz1t2Zqic::Bfo8yi4JK()
Scope Name
Wc1i7beA
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wc1i7beA
Assembly Version
22.19.2.282
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1399
Main Method
System.Void Wc1i7beA.Pz1t2Zqic::Bfo8yi4JK()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object Wc1i7beA.RenoLedger.Cdy43n/yMx43.gH_6te4T::3xjMoXk1R4wrxF(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Wc1i7beA.Pz1t2Zqic::iWe53jzD(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void Wc1i7beA.Pz1t2Zqic::Se6ta4bC9Ttid(System.Object[],System.Int32)
nop <null>
ret <null>
4abdbf5a0ba2aa1b307d46c5af5577cd
.Net Resources
Tafinobix.kbfida.levi
Wc1i7beA.Resources.resources
a221d2ab1aeb0a.Resources.resources
7cbd3e3e0
[NBF]root.Data
7cbd3e3e1
[NBF]root.Data
7cbd3e3e2
[NBF]root.Data
7cbd3e3e3
[NBF]root.Data
7cbd3e3e4
[NBF]root.Data
7cbd3e3e5
[NBF]root.Data
7cbd3e3e6
[NBF]root.Data
7cbd3e3e7
[NBF]root.Data
7cbd3e3e8
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
ID:0037
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙