Malicious
Malicious

4aeff1b8916c6a4c9e6b4c65f4012994

Share on LinkedIn
Print
PE Executable
MD5: 4aeff1b8916c6a4c9e6b4c65f4012994
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4aeff1b8916c6a4c9e6b4c65f4012994
Sha1 66da0fd03399463971ca71d898a8f2ec49a13c4e
Sha256 942f2668e6611ce547411ba1a04224aefe461acf710f29a9ce7663607a125b41
Sha384 3e14666c7250c2fc94020d799ffbe4fa4489e0a529e845f6d4756ce2c7ed918aa3a71b6f929ec069539f91e07c8815a5
Sha512 9e78ea7bf63245ce8061e20aeb510811d202f57753e0745496974c6debcd8f25e43f239e9eac5c86ba5f2b9210be53ce5e649e473df0e521db0ae54ebef8f6ce
SSDeep 24576:nTvc9/WMOC7kbmf5GU77Rafm+jSHFxoKs2:nrc9/jsmRGs7RijJ2
TLSH 2805BF3B37914E21D24A53B3C1C7490187EA8A4776ABEB0B318513D61D473EEDE0B69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4aeff1b8916c6a4c9e6b4c65f4012994
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CeBoGcejhklMOuANqc.SYJMw1s2iT6Z9fMLqX
I0uyfcqj02JYrtAkfu.SB1oVCN8TVUCfvFfFF
90Lw1X2oaK55momWX0.AEyJQGTKMRbFxgO18N
gj3tVaxc2tWdetE3tj.QHPCItBl2cnPO4TaqG
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Znnsrsneby.exe
Full Name
Znnsrsneby.exe
EntryPoint
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Scope Name
Znnsrsneby.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znnsrsneby
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_01C0: ret
ldsfld XYsyiBy2t0AYPuNJuw1 XYsyiBy2t0AYPuNJuw1::HwiyTFFv7t
call System.Void XYsyiBy2t0AYPuNJuw1::jgVyiUBYbY(XYsyiBy2t0AYPuNJuw1)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_3112a2d9824147f3b72244ffa553053d
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld kaxowryenUT1ODRKigO kaxowryenUT1ODRKigO::Uj4ysBiQfs
call System.Byte[] kaxowryenUT1ODRKigO::jgVyiUBYbY(kaxowryenUT1ODRKigO)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1d6dcbe72d2d414ba6c7574b3d6a26df
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_0149,IL_00BF)
br IL_009B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009B: ldloc V_0
br IL_00BF: ldc.i4 438692568
ldc.i4 438692568
ldc.i4 -1578773810
sub <null>
ldc.i4 2145276487
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_6e7be5e36d114025922d22796f7a2672
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
ldc.i4 1537000997
ldc.i4 1274381030
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_f1648021682d4dfd9b921c71acadcaa8
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
newobj System.Void rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zJWoPTylGsdVh4Z5Xup zJWoPTylGsdVh4Z5Xup::bjfyEWoVm2
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 zJWoPTylGsdVh4Z5Xup::jgVyiUBYbY(System.Object,System.Byte[],zJWoPTylGsdVh4Z5Xup)
ldsfld XbL75IyXNCvUm7VrVND XbL75IyXNCvUm7VrVND::FvJyCWlxA1
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 XbL75IyXNCvUm7VrVND::jgVyiUBYbY(System.Object,XbL75IyXNCvUm7VrVND)
ldsfld t3l8BsyZ87n0O235NGr t3l8BsyZ87n0O235NGr::DZtypBQkq6
call System.Void t3l8BsyZ87n0O235NGr::jgVyiUBYbY(System.Object,t3l8BsyZ87n0O235NGr)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_c568a00227ff4dc5abe54082fb76430d
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0149,IL_00BF)
leave IL_01C0: ret
pop <null>
ldc.i4 5
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_e631541dd5fb46e2be6b149264e4b2f7
brtrue IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_017C: ldloc V_2
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1602eca952404cecb5de816cff8b4dc8
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
Module Name
Znnsrsneby.exe
Full Name
Znnsrsneby.exe
EntryPoint
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Scope Name
Znnsrsneby.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znnsrsneby
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ws59EHadWKep47dCS0.f5PMKXy04cWx7laDwF::XdQlE5s74()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_01C0: ret
ldsfld XYsyiBy2t0AYPuNJuw1 XYsyiBy2t0AYPuNJuw1::HwiyTFFv7t
call System.Void XYsyiBy2t0AYPuNJuw1::jgVyiUBYbY(XYsyiBy2t0AYPuNJuw1)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_3112a2d9824147f3b72244ffa553053d
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld kaxowryenUT1ODRKigO kaxowryenUT1ODRKigO::Uj4ysBiQfs
call System.Byte[] kaxowryenUT1ODRKigO::jgVyiUBYbY(kaxowryenUT1ODRKigO)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1d6dcbe72d2d414ba6c7574b3d6a26df
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 4
br IL_009F: switch(IL_0149,IL_00BF)
br IL_009B: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009B: ldloc V_0
br IL_00BF: ldc.i4 438692568
ldc.i4 438692568
ldc.i4 -1578773810
sub <null>
ldc.i4 2145276487
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_6e7be5e36d114025922d22796f7a2672
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
ldc.i4 1537000997
ldc.i4 1274381030
xor <null>
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_f1648021682d4dfd9b921c71acadcaa8
xor <null>
ldsfld Ro1RpSyyDnJfe1KmbRr Ro1RpSyyDnJfe1KmbRr::cORyaluvHX
call System.String Ro1RpSyyDnJfe1KmbRr::jgVyiUBYbY(System.Int32,Ro1RpSyyDnJfe1KmbRr)
newobj System.Void rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld zJWoPTylGsdVh4Z5Xup zJWoPTylGsdVh4Z5Xup::bjfyEWoVm2
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 zJWoPTylGsdVh4Z5Xup::jgVyiUBYbY(System.Object,System.Byte[],zJWoPTylGsdVh4Z5Xup)
ldsfld XbL75IyXNCvUm7VrVND XbL75IyXNCvUm7VrVND::FvJyCWlxA1
call rK9yxOxgfbeYV1KwmPD.Q9WORCxi7CtRYAhXCe8 XbL75IyXNCvUm7VrVND::jgVyiUBYbY(System.Object,XbL75IyXNCvUm7VrVND)
ldsfld t3l8BsyZ87n0O235NGr t3l8BsyZ87n0O235NGr::DZtypBQkq6
call System.Void t3l8BsyZ87n0O235NGr::jgVyiUBYbY(System.Object,t3l8BsyZ87n0O235NGr)
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_c568a00227ff4dc5abe54082fb76430d
brtrue IL_009F: switch(IL_0149,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0149,IL_00BF)
leave IL_01C0: ret
pop <null>
ldc.i4 5
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_e631541dd5fb46e2be6b149264e4b2f7
brtrue IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_017C: ldloc V_2
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 0
ldsfld <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3} <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_76c3c390535f477da31ea96f6c5a0939
ldfld System.Int32 <Module>{e7557216-5da2-4509-a72c-bf1de51e9ea3}::m_1602eca952404cecb5de816cff8b4dc8
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙