Malicious
Malicious

4fc0bc0b2757953a1ca56581448e8960

PE Executable
MD5: 4fc0bc0b2757953a1ca56581448e8960
Size: 1.24 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.24 MB · 1,239,040 B
First seen
2026-10-19 08:15 · 6 days ago
Last seen
2026-10-19 08:15 · 6 days ago
Last analysis
2026-10-19 16:18 · 6 days ago
Hashes
MD5 4fc0bc0b2757953a1ca56581448e8960 Sha1 643b3563d3145c38db70fdbbcc348e763ce23873 Sha256 bee83b3e9e49afa1d4a87a7ddf0f18e526f8d1aa4e8ee56da28c60e9adaa2df6 Sha384 4e6de5fcd4154d1e663f1ab316160876de6c4a4d9545ec8a4e9b4f6fd2bc053db016f88b6503396c1d95609267d0eb55 Sha512 052fff2ba9a0c3dd247fb9a772c635d4e14dd6039fb4c00735157e26b0bb92343a6c6e782838b3a8edff23cd939fa10a3cc2a1230efedbce0f7e232d05e8b87d SSDeep 24576:nL+qj0qdPBlLeJEL6zlK6fIeBad/rz5yPrzJxDeHwBzxomlES0/hrH:nTPlLeCuA6weAfyPrzDfzxlES0J TLSH DF4502646B26E802C654533645F2E2B403795EDAE812D357AFE87EDB7E3AF120D80353
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 42 files
EXE4fc0bc0b2757953a1ca56581448e8960
Structure
BINResources
BINRT_ICON
BINID:0001
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINm6.Ce.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINfDG.eD2.resources
BINNJ
DATA[NBF]root.Data
BINIMf.HM9.resources
BINaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINprogressBar1.Modifiers
BIN$this.Language
BIN$this.GridSize
BINQQC.Properties.Resources.resources
BINh17 (5)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINh17 (4)
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa4
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINh21
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINa9 (7)
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINa9 (2)
IMG[NBF]root.Data
EXIF[NBF]root.Data.exif
IMG[NBF]root.Data-preview.png
BINvual
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>img>img
Shape pe:exe>img>img
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Name Value
Module Name
bkkd.exe
Full Name
bkkd.exe
EntryPoint
System.Void li5.qiO::xih()
Scope Name
bkkd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bkkd
Assembly Version
5.3.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
434
Info
PDB Path: bkkd.pdb
Main Method
System.Void li5.qiO::xih()
Main IL Instruction Count
12
Main IL 
br IL_0006: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ret <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0010: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_001B: call System.Void xNv.iNt::Xf1()
call System.Void xNv.iNt::Xf1()
br IL_0025: newobj System.Void fDG.eD2::.ctor()
newobj System.Void fDG.eD2::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: ret
Module Name
bkkd.exe
Full Name
bkkd.exe
EntryPoint
System.Void li5.qiO::xih()
Scope Name
bkkd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bkkd
Assembly Version
5.3.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
434
Main Method
System.Void li5.qiO::xih()
Main IL Instruction Count
12
Main IL 
br IL_0006: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ret <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_0010: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_001B: call System.Void xNv.iNt::Xf1()
call System.Void xNv.iNt::Xf1()
br IL_0025: newobj System.Void fDG.eD2::.ctor()
newobj System.Void fDG.eD2::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_0005: ret
1 malicious · 42 files
EXE4fc0bc0b2757953a1ca56581448e8960
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙