Malicious
Malicious

4aeff1b8916c6a4c9e6b4c65f4012994

PE Executable
MD5: 4aeff1b8916c6a4c9e6b4c65f4012994
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4aeff1b8916c6a4c9e6b4c65f4012994
Sha1 66da0fd03399463971ca71d898a8f2ec49a13c4e
Sha256 942f2668e6611ce547411ba1a04224aefe461acf710f29a9ce7663607a125b41
Sha384 3e14666c7250c2fc94020d799ffbe4fa4489e0a529e845f6d4756ce2c7ed918aa3a71b6f929ec069539f91e07c8815a5
Sha512 9e78ea7bf63245ce8061e20aeb510811d202f57753e0745496974c6debcd8f25e43f239e9eac5c86ba5f2b9210be53ce5e649e473df0e521db0ae54ebef8f6ce
SSDeep 24576:nTvc9/WMOC7kbmf5GU77Rafm+jSHFxoKs2:nrc9/jsmRGs7RijJ2
TLSH 2805BF3B37914E21D24A53B3C1C7490187EA8A4776ABEB0B318513D61D473EEDE0B69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4aeff1b8916c6a4c9e6b4c65f4012994
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CeBoGcejhklMOuANqc.SYJMw1s2iT6Z9fMLqX
I0uyfcqj02JYrtAkfu.SB1oVCN8TVUCfvFfFF
90Lw1X2oaK55momWX0.AEyJQGTKMRbFxgO18N
gj3tVaxc2tWdetE3tj.QHPCItBl2cnPO4TaqG
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Znnsrsneby.exe
Full Name
Znnsrsneby.exe
EntryPoint
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Scope Name
Znnsrsneby.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znnsrsneby
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_01C0: ret
ldsfld XYsyiBy2t0AYPuNJuw1 XYsyiBy2t0AYPuNJuw1::HwiyTFFv7t
call System.Void XYsyiBy2t0AYPuNJuw1::jgVyiUBYbY(XYsyiBy2t0AYPuNJuw1)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_3112a2d9824147f3b72244ffa553053d
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld kaxowryenUT1ODRKigO kaxowryenUT1ODRKigO::Uj4ysBiQfs
call System.Byte[] kaxowryenUT1ODRKigO::jgVyiUBYbY(kaxowryenUT1ODRKigO)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1d6dcbe72d2d414ba6c7574b3d6a26df
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_0149,IL_00BF)
br IL_009B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009B: ldloc V_0
br IL_00BF: ldc.i4 438692568
ldc.i4 438692568
ldc.i4 -1578773810
sub <null>
ldc.i4 2145276487
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_6e7be5e36d114025922d22796f7a2672
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
ldc.i4 1537000997
ldc.i4 1274381030
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_f1648021682d4dfd9b921c71acadcaa8
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
newobj System.Void rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zJWoPTylGsdVh4Z5Xup zJWoPTylGsdVh4Z5Xup::bjfyEWoVm2
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 zJWoPTylGsdVh4Z5Xup::jgVyiUBYbY(System.Object,System.Byte[],zJWoPTylGsdVh4Z5Xup)
ldsfld XbL75IyXNCvUm7VrVND XbL75IyXNCvUm7VrVND::FvJyCWlxA1
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 XbL75IyXNCvUm7VrVND::jgVyiUBYbY(System.Object,XbL75IyXNCvUm7VrVND)
ldsfld t3l8BsyZ87n0O235NGr t3l8BsyZ87n0O235NGr::DZtypBQkq6
call System.Void t3l8BsyZ87n0O235NGr::jgVyiUBYbY(System.Object,t3l8BsyZ87n0O235NGr)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_c568a00227ff4dc5abe54082fb76430d
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0149,IL_00BF)
leave IL_01C0: ret
pop <null>
ldc.i4 5
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_e631541dd5fb46e2be6b149264e4b2f7
brtrue IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_017C: ldloc V_2
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1602eca952404cecb5de816cff8b4dc8
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
Module Name
Znnsrsneby.exe
Full Name
Znnsrsneby.exe
EntryPoint
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Scope Name
Znnsrsneby.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znnsrsneby
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_01C0: ret
ldsfld XYsyiBy2t0AYPuNJuw1 XYsyiBy2t0AYPuNJuw1::HwiyTFFv7t
call System.Void XYsyiBy2t0AYPuNJuw1::jgVyiUBYbY(XYsyiBy2t0AYPuNJuw1)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_3112a2d9824147f3b72244ffa553053d
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld kaxowryenUT1ODRKigO kaxowryenUT1ODRKigO::Uj4ysBiQfs
call System.Byte[] kaxowryenUT1ODRKigO::jgVyiUBYbY(kaxowryenUT1ODRKigO)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1d6dcbe72d2d414ba6c7574b3d6a26df
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_0149,IL_00BF)
br IL_009B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009B: ldloc V_0
br IL_00BF: ldc.i4 438692568
ldc.i4 438692568
ldc.i4 -1578773810
sub <null>
ldc.i4 2145276487
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_6e7be5e36d114025922d22796f7a2672
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
ldc.i4 1537000997
ldc.i4 1274381030
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_f1648021682d4dfd9b921c71acadcaa8
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
newobj System.Void rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zJWoPTylGsdVh4Z5Xup zJWoPTylGsdVh4Z5Xup::bjfyEWoVm2
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 zJWoPTylGsdVh4Z5Xup::jgVyiUBYbY(System.Object,System.Byte[],zJWoPTylGsdVh4Z5Xup)
ldsfld XbL75IyXNCvUm7VrVND XbL75IyXNCvUm7VrVND::FvJyCWlxA1
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 XbL75IyXNCvUm7VrVND::jgVyiUBYbY(System.Object,XbL75IyXNCvUm7VrVND)
ldsfld t3l8BsyZ87n0O235NGr t3l8BsyZ87n0O235NGr::DZtypBQkq6
call System.Void t3l8BsyZ87n0O235NGr::jgVyiUBYbY(System.Object,t3l8BsyZ87n0O235NGr)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_c568a00227ff4dc5abe54082fb76430d
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0149,IL_00BF)
leave IL_01C0: ret
pop <null>
ldc.i4 5
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_e631541dd5fb46e2be6b149264e4b2f7
brtrue IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_017C: ldloc V_2
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1602eca952404cecb5de816cff8b4dc8
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
4aeff1b8916c6a4c9e6b4c65f4012994
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CeBoGcejhklMOuANqc.SYJMw1s2iT6Z9fMLqX
I0uyfcqj02JYrtAkfu.SB1oVCN8TVUCfvFfFF
90Lw1X2oaK55momWX0.AEyJQGTKMRbFxgO18N
gj3tVaxc2tWdetE3tj.QHPCItBl2cnPO4TaqG
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙