Malicious
Malicious

4ec261961a71f49e305b2d3721913397

Share on LinkedIn
Print
PE Executable
MD5: 4ec261961a71f49e305b2d3721913397
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4ec261961a71f49e305b2d3721913397
Sha1 6f72890e4cfd7ffed298c430ee6e1d59b7b19623
Sha256 5e35657875682dc8e58f803a9cc7142d3d583558d42b5eb3da9e1b87d41be5ec
Sha384 d56e08a9439e0281b68ddb0655d28db07efe675ca3d90be762ef6aff2dc8b3605bcc2a90f90afe341efb337727102f97
Sha512 7b6bfcc7643c109c32b36e930be6757465055b9e9a4d283d9e22024886c29ddc9a6953e6d4ecadefa5fefb79e5b8881b3941d1026932a854bc75ff65ba3b76da
SSDeep 12288:6uUL/ZovCXFdH8K+2RBcpz6ras8ocA+2JRIGZU07vM0pXFn8idR0P8QTIHpO:ihXFdcsEpzB2oytpRdRNS
TLSH 8A05AF3A32925E22C24A1373C1C74900C7EA879B6A97EB0B719413E61D477FEDE07697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4ec261961a71f49e305b2d3721913397
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
GTqPsEuCTE0NEFjqKK.FyrMOERvN2oSwI1tP3
w0TPuUWcm3OSqr8viE.Apk9R3lPQXLKsUihEG
Zo7wyc1WZqsyuFfAWw.OakxDCcIVhZ9SVERQq
Csmp8oh4n4XH0d7Yj6.A2lcWtKd3wiUYvnRxd
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rhwqlnnbjyj.exe
Full Name
Rhwqlnnbjyj.exe
EntryPoint
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Scope Name
Rhwqlnnbjyj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rhwqlnnbjyj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
nop <null>
ldsfld FWaVvJJWGbnlpS9m7sU FWaVvJJWGbnlpS9m7sU::UjhJltHM73
call System.Byte[] FWaVvJJWGbnlpS9m7sU::cSjJOMYO38(FWaVvJJWGbnlpS9m7sU)
stloc.s V_0
ldc.i4 6
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_b4e47dad4b4142d08034237ce8a0f7ae
brtrue IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_011A: leave IL_0191
ldc.i4 307101786
ldc.i4 814623326
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_a86f985fb19d4821832fb8517a1d4ef0
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
ldc.i4 -1098471444
ldc.i4 -883181674
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_5324c25c102743b5a8243e00acc58dcc
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
newobj System.Void B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iMWpuLJY3o6gkf1bsYk iMWpuLJY3o6gkf1bsYk::k4UJxpCLHu
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P iMWpuLJY3o6gkf1bsYk::cSjJOMYO38(System.Object,System.Byte[],iMWpuLJY3o6gkf1bsYk)
ldsfld ebyGeKJ51frOK2mmZ66 ebyGeKJ51frOK2mmZ66::NEOJ3rNhmw
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P ebyGeKJ51frOK2mmZ66::cSjJOMYO38(System.Object,ebyGeKJ51frOK2mmZ66)
ldsfld w7q2hYJtnhfKXoJtns1 w7q2hYJtnhfKXoJtns1::srJJa6M7o9
call System.Void w7q2hYJtnhfKXoJtns1::cSjJOMYO38(System.Object,w7q2hYJtnhfKXoJtns1)
ldc.i4 7
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_27000dc32f22467f9617ace0b135ef22
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 2
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3c8e5aca0cc04a5281e1514bc8756f3c
brfalse IL_0151: switch(IL_016D)
pop <null>
ldc.i4 0
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_014D: ldloc V_3
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 0
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3b4f94369d584973a06795132d492aef
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
ret <null>
ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
call System.Void OicZnCJ1oICZcR7y3c3::cSjJOMYO38(OicZnCJ1oICZcR7y3c3)
ldc.i4 1
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_12553f0e5f9444788a30202ba96739f6
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
Module Name
Rhwqlnnbjyj.exe
Full Name
Rhwqlnnbjyj.exe
EntryPoint
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Scope Name
Rhwqlnnbjyj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rhwqlnnbjyj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GqhcKUqANj7e6QQ7M4.dwZNcLJZquanmeoe8S::iFUYDetLH()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
nop <null>
ldsfld FWaVvJJWGbnlpS9m7sU FWaVvJJWGbnlpS9m7sU::UjhJltHM73
call System.Byte[] FWaVvJJWGbnlpS9m7sU::cSjJOMYO38(FWaVvJJWGbnlpS9m7sU)
stloc.s V_0
ldc.i4 6
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_b4e47dad4b4142d08034237ce8a0f7ae
brtrue IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_011A: leave IL_0191
ldc.i4 307101786
ldc.i4 814623326
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_a86f985fb19d4821832fb8517a1d4ef0
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
ldc.i4 -1098471444
ldc.i4 -883181674
xor <null>
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_5324c25c102743b5a8243e00acc58dcc
xor <null>
ldsfld WY80FKJJ2NukU2gIXqo WY80FKJJ2NukU2gIXqo::t1gJq5u5gu
call System.String WY80FKJJ2NukU2gIXqo::cSjJOMYO38(System.Int32,WY80FKJJ2NukU2gIXqo)
newobj System.Void B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iMWpuLJY3o6gkf1bsYk iMWpuLJY3o6gkf1bsYk::k4UJxpCLHu
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P iMWpuLJY3o6gkf1bsYk::cSjJOMYO38(System.Object,System.Byte[],iMWpuLJY3o6gkf1bsYk)
ldsfld ebyGeKJ51frOK2mmZ66 ebyGeKJ51frOK2mmZ66::NEOJ3rNhmw
call B8sOSch06XB7g6lL6CB.Fy1ELHhOv9KdEKLPd0P ebyGeKJ51frOK2mmZ66::cSjJOMYO38(System.Object,ebyGeKJ51frOK2mmZ66)
ldsfld w7q2hYJtnhfKXoJtns1 w7q2hYJtnhfKXoJtns1::srJJa6M7o9
call System.Void w7q2hYJtnhfKXoJtns1::cSjJOMYO38(System.Object,w7q2hYJtnhfKXoJtns1)
ldc.i4 7
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_27000dc32f22467f9617ace0b135ef22
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 2
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3c8e5aca0cc04a5281e1514bc8756f3c
brfalse IL_0151: switch(IL_016D)
pop <null>
ldc.i4 0
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_014D: ldloc V_3
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 0
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_3b4f94369d584973a06795132d492aef
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
ret <null>
ldsfld OicZnCJ1oICZcR7y3c3 OicZnCJ1oICZcR7y3c3::zGUJcKeNlc
call System.Void OicZnCJ1oICZcR7y3c3::cSjJOMYO38(OicZnCJ1oICZcR7y3c3)
ldc.i4 1
ldsfld <Module>{00783755-6085-4b80-9a82-d86d766b3403} <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_f64e94d1e1ce4c0fb4d9169b6f8b56e3
ldfld System.Int32 <Module>{00783755-6085-4b80-9a82-d86d766b3403}::m_12553f0e5f9444788a30202ba96739f6
brtrue IL_0014: switch(IL_0191,IL_0038,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0191,IL_0038,IL_0192)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙