Deep Malware Analysis of 536dda8165b4293aadaac8b6fab71fe5 | md5: 536dda8165b4293aadaac8b6fab71fe5 | Executable | PE (Portable Executable) | .Net Obfuscator | .Net Reactor | .Net | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | SOS: 0.47

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	536dda8165b4293aadaac8b6fab71fe5
Sha1	0829048ac74458bcb1b23448423ab9e3b8c2d70f
Sha256	0f2373242b8a12ee81a702e7218deeb0d54f2e1d1c92dcde4ddcab6cdf4261af
Sha384	c858cdf8790f13e92b1e0672d9984dc5779e78d9f62de0a2c08264eb14b85ddab981d1e4794b09dc0cd6bf110be840ce
Sha512	e061162c9b520122556439a6b75004d0e703ef7d7d0866d2c157a4de60c689428be56a68ddf532e0fee8cccd856d19a30ba41595fb64009ff3bcb80a2b977099
SSDeep	393216:pa3OLyHrLxeaXw8k1AlejUsIYianprSO+ct7Xz5dxs8Jz:leLLxeaXw1AlejG2prO47X6c
TLSH	B9F6120FF996CDB2E206233EC4D755404BA1ED41B217DA0A6EAA73A17473FBB8435247

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Name	Value
Module Name	FAST COMMUNITY.exe
Full Name	FAST COMMUNITY.exe
EntryPoint	System.Void —ˆ.—‡::—‰()
Scope Name	FAST COMMUNITY.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	FAST COMMUNITY
Assembly Version	1.0.2.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	461d39c4a423da0b
Target Framework	.NETFramework,Version=v4.8
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_0f343b09.bin (1024 bytes)
Info	PDB Path: FAST COMMUNITY.pdb
Total Strings	184
Main Method	System.Void —ˆ.—‡::—‰()
Main IL Instruction Count	100
Main IL	br.s IL_0007: br IL_005E call <null> br IL_005E: call System.Void ˆ.ˆŽ::Ž‘’() ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_0068: nop br IL_0160: ret br IL_018C: call System.Void ˜ž.˜::™Œ() call System.Void ˜ž.˜::™Š() br IL_0177: nop call System.Void ˆ.ˆŽ::Ž‘’() br IL_00D7: nop nop <null> call System.Void ˜›.˜š::˜œ() ldc.i4 1 ldsfld <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9} <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_aed7d54c7ab34099ba3df786748d2736 ldfld System.Int32 <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_40db4f7a5b3a4054b633ee4e0256ebc6 brtrue IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) pop <null> ldc.i4 1 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) call System.Void ˆ‰.ˆˆ::Ž–() ldc.i4 0 ldsfld <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9} <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_aed7d54c7ab34099ba3df786748d2736 ldfld System.Int32 <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_e748d5bb4c0046c284461be77901d404 brtrue IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) pop <null> ldc.i4 0 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) ldloc.s V_0 brfalse IL_0054: call System.Void ˜ž.˜::™Š() ldc.i4 8 ldsfld <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9} <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_aed7d54c7ab34099ba3df786748d2736 ldfld System.Int32 <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_65059ed7ccb74f3c9771b0576c0f0d24 brfalse IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) pop <null> ldc.i4 4 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) nop <null> call System.Void —‹.—Š::—Œ() ldc.i4 10 ldsfld <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9} <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_aed7d54c7ab34099ba3df786748d2736 ldfld System.Int32 <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_12bd9ee787454dc5871755eaa8e86cd7 brfalse IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) pop <null> ldc.i4 9 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) ldloca.s V_1 call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult() ldc.i4.0 <null> ceq <null> stloc.s V_0 br IL_00B1: ldloc.s V_0 nop <null> ldsfld Š“ Š“::Š“ call System.Void Š“::‰–œ(Š“) ldc.i4 4 ldsfld <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9} <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_aed7d54c7ab34099ba3df786748d2736 ldfld System.Int32 <Module>{043c77a3-d0a8-4f87-bb35-5e85ee52e7c9}::m_97a1055c0b864acc8ab87e9b02a3b03d brtrue IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) pop <null> ldc.i4 5 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) nop <null> call System.Threading.Tasks.Task`1<System.Boolean> ”.“::•() callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter() stloc.s V_1 ldc.i4 11 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) ldloc.s V_2 brfalse IL_018C: call System.Void ˜ž.˜::™Œ() ldc.i4 6 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) nop <null> ret <null> nop <null> ldc.i4.0 <null> ldsfld Š“‘ Š“‘::Š“’ call System.Void Š“‘::‰–œ(System.Boolean,Š“‘) ldc.i4 7 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) nop <null> call System.Boolean ˜ž.˜::™‹() ldc.i4.0 <null> ceq <null> stloc.s V_2 ldc.i4 2 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) call System.Void ˜ž.˜::™Œ() ldc.i4 3 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) nop <null> newobj System.Void ž.::.ctor() ldsfld Š““ Š““::Š“” call System.Void Š““::‰–œ(System.Windows.Forms.Form,Š““) ldc.i4 9 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC) br IL_0160: ret ldc.i4 4 br IL_0010: switch(IL_0068,IL_0137,IL_014E,IL_019B,IL_0054,IL_0161,IL_004A,IL_008D,IL_01B5,IL_015F,IL_010D,IL_00FC)