Malicious
Malicious

4ec261961a71f49e305b2d3721913397

PE Executable
MD5: 4ec261961a71f49e305b2d3721913397
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4ec261961a71f49e305b2d3721913397
Sha1 6f72890e4cfd7ffed298c430ee6e1d59b7b19623
Sha256 5e35657875682dc8e58f803a9cc7142d3d583558d42b5eb3da9e1b87d41be5ec
Sha384 d56e08a9439e0281b68ddb0655d28db07efe675ca3d90be762ef6aff2dc8b3605bcc2a90f90afe341efb337727102f97
Sha512 7b6bfcc7643c109c32b36e930be6757465055b9e9a4d283d9e22024886c29ddc9a6953e6d4ecadefa5fefb79e5b8881b3941d1026932a854bc75ff65ba3b76da
SSDeep 12288:6uUL/ZovCXFdH8K+2RBcpz6ras8ocA+2JRIGZU07vM0pXFn8idR0P8QTIHpO:ihXFdcsEpzB2oytpRdRNS
TLSH 8A05AF3A32925E22C24A1373C1C74900C7EA879B6A97EB0B719413E61D477FEDE07697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4ec261961a71f49e305b2d3721913397
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GTqPsEuCTE0NEFjqKK.FyrMOERvN2oSwI1tP3
w0TPuUWcm3OSqr8viE.Apk9R3lPQXLKsUihEG
Zo7wyc1WZqsyuFfAWw.OakxDCcIVhZ9SVERQq
Csmp8oh4n4XH0d7Yj6.A2lcWtKd3wiUYvnRxd
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rhwqlnnbjyj.exe
Full Name
Rhwqlnnbjyj.exe
EntryPoint
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Scope Name
Rhwqlnnbjyj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rhwqlnnbjyj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
nop <null>
ldsfld FWaVvJJWGbnlpS9m7sU FWaVvJJWGbnlpS9m7sU::UjhJltHM73
call System.Byte[] FWaVvJJWGbnlpS9m7sU::cSjJOMYO38(FWaVvJJWGbnlpS9m7sU)
stloc.s V_0
ldc.i4 6
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_b4e47dad4b4142d08034237ce8a0f7ae
brtrue IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_011A: leave IL_0191
ldc.i4 307101786
ldc.i4 814623326
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_a86f985fb19d4821832fb8517a1d4ef0
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
ldc.i4 -1098471444
ldc.i4 -883181674
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_5324c25c102743b5a8243e00acc58dcc
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
newobj System.Void B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iMWpuLJY3o6gkf1bsYk iMWpuLJY3o6gkf1bsYk::k4UJxpCLHu
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P iMWpuLJY3o6gkf1bsYk::cSjJOMYO38(System.Object,System.Byte[],iMWpuLJY3o6gkf1bsYk)
ldsfld ebyGeKJ51frOK2mmZ66 ebyGeKJ51frOK2mmZ66::NEOJ3rNhmw
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P ebyGeKJ51frOK2mmZ66::cSjJOMYO38(System.Object,ebyGeKJ51frOK2mmZ66)
ldsfld w7q2hYJtnhfKXoJtns1 w7q2hYJtnhfKXoJtns1::srJJa6M7o9
call System.Void w7q2hYJtnhfKXoJtns1::cSjJOMYO38(System.Object,w7q2hYJtnhfKXoJtns1)
ldc.i4 7
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_27000dc32f22467f9617ace0b135ef22
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 2
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3c8e5aca0cc04a5281e1514bc8756f3c
brfalse IL_0151: switch(IL_016D)
pop <null>
ldc.i4 0
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_014D: ldloc V_3
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 0
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3b4f94369d584973a06795132d492aef
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
ret <null>
ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
call System.Void OicZnCJ1oICZcR7y3c3::cSjJOMYO38(OicZnCJ1oICZcR7y3c3)
ldc.i4 1
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_12553f0e5f9444788a30202ba96739f6
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
Module Name
Rhwqlnnbjyj.exe
Full Name
Rhwqlnnbjyj.exe
EntryPoint
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Scope Name
Rhwqlnnbjyj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rhwqlnnbjyj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
nop <null>
ldsfld FWaVvJJWGbnlpS9m7sU FWaVvJJWGbnlpS9m7sU::UjhJltHM73
call System.Byte[] FWaVvJJWGbnlpS9m7sU::cSjJOMYO38(FWaVvJJWGbnlpS9m7sU)
stloc.s V_0
ldc.i4 6
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_b4e47dad4b4142d08034237ce8a0f7ae
brtrue IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_011A: leave IL_0191
ldc.i4 307101786
ldc.i4 814623326
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_a86f985fb19d4821832fb8517a1d4ef0
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
ldc.i4 -1098471444
ldc.i4 -883181674
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_5324c25c102743b5a8243e00acc58dcc
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
newobj System.Void B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iMWpuLJY3o6gkf1bsYk iMWpuLJY3o6gkf1bsYk::k4UJxpCLHu
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P iMWpuLJY3o6gkf1bsYk::cSjJOMYO38(System.Object,System.Byte[],iMWpuLJY3o6gkf1bsYk)
ldsfld ebyGeKJ51frOK2mmZ66 ebyGeKJ51frOK2mmZ66::NEOJ3rNhmw
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P ebyGeKJ51frOK2mmZ66::cSjJOMYO38(System.Object,ebyGeKJ51frOK2mmZ66)
ldsfld w7q2hYJtnhfKXoJtns1 w7q2hYJtnhfKXoJtns1::srJJa6M7o9
call System.Void w7q2hYJtnhfKXoJtns1::cSjJOMYO38(System.Object,w7q2hYJtnhfKXoJtns1)
ldc.i4 7
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_27000dc32f22467f9617ace0b135ef22
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 2
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3c8e5aca0cc04a5281e1514bc8756f3c
brfalse IL_0151: switch(IL_016D)
pop <null>
ldc.i4 0
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_014D: ldloc V_3
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 0
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3b4f94369d584973a06795132d492aef
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
ret <null>
ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
call System.Void OicZnCJ1oICZcR7y3c3::cSjJOMYO38(OicZnCJ1oICZcR7y3c3)
ldc.i4 1
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_12553f0e5f9444788a30202ba96739f6
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
4ec261961a71f49e305b2d3721913397
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GTqPsEuCTE0NEFjqKK.FyrMOERvN2oSwI1tP3
w0TPuUWcm3OSqr8viE.Apk9R3lPQXLKsUihEG
Zo7wyc1WZqsyuFfAWw.OakxDCcIVhZ9SVERQq
Csmp8oh4n4XH0d7Yj6.A2lcWtKd3wiUYvnRxd
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙