Malicious
Malicious

5500207c170d4ba2cdb301ec87a2db6a

PE Executable
MD5: 5500207c170d4ba2cdb301ec87a2db6a
Size: 569.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5500207c170d4ba2cdb301ec87a2db6a
Sha1 e2dbaad6794722e575c9b43bf78a9ebc404c7a38
Sha256 321412c9e3b62d010fa039be0c56f2440910082abcf36597de697240ffba4011
Sha384 3a08695ee4febe0cbbeafc06392688505dcc155cb0a3a6f11d65b9cf09566e6e5a62e946282cc798c9690d99420f3095
Sha512 121dd6f7b0a93a6a10a9e965f14a96a3a73818c3969188b547822793757fd26516b07287a11974ea6d4685a865d17b5bd172ed4108665b02a5f9700317c0300f
SSDeep 12288:yW+0epmeEj2KqFXqZYyZicQBeNIPsqNV:V+rJFXqZDixeNIPz
TLSH 5DC45C1B36914E90C28457B7E1DB950083A2AA86F9E3F30FB28413A61D177FED947793
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5500207c170d4ba2cdb301ec87a2db6a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aOHUJ1dfGA65G1VO17.7Stk07JmvZSnyelrmw
n7Siswy255UKLcGWhi.yuRSQiExMJtHF5R7OO
NUt1auMV2XXjF5XEmG.P4OQsxQvZn5D9Pt6PX
l1Mgsnkwa5kMxJbwPM.LZM6hib27iy7HO1g18
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ljlgzhpyr.exe
Full Name
Ljlgzhpyr.exe
EntryPoint
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Scope Name
Ljlgzhpyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ljlgzhpyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_018E: ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
nop <null>
ldsfld qLTvYVSR7jtHijq3doE qLTvYVSR7jtHijq3doE::JAaS8HmSOg
call System.Byte[] qLTvYVSR7jtHijq3doE::SYwSjp6tuC(qLTvYVSR7jtHijq3doE)
stloc.s V_1
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_23d059419a084a0b8d577232b7b48839
brfalse IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0117,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 -1824795971
ldc.i4 -1824795971
ldc.i4 971877187
xor <null>
ldc.i4 -235902517
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_1e13e15e11334b17ad11e7f30ad2ce7c
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
ldc.i4 1356706430
ldc.i4 -853866393
add <null>
ldc.i4 173283261
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_0543f64aa27f43b7ad599f485cea0272
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
newobj System.Void LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K::.ctor(System.String,System.String)
newobj System.Void AP9T3wbMkmYyJHbMaNL.eoBk1lbJgXL9T29geqF::.ctor(LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K)
ldloc.s V_1
ldsfld RD8NP7SltTpT6tdN0S2 RD8NP7SltTpT6tdN0S2::fteSzD4xlP
call System.Void RD8NP7SltTpT6tdN0S2::SYwSjp6tuC(System.Object,System.Byte[],RD8NP7SltTpT6tdN0S2)
ldc.i4 1
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_00e804e97f864ab48824aad52de94d84
brtrue IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0117,IL_0096)
leave IL_01B7: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_6bcb9c28eec9409cbf68941011f05779
brfalse IL_014E: switch(IL_016A)
pop <null>
ldc.i4 2
br IL_014E: switch(IL_016A)
br IL_014A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014A: ldloc V_0
br IL_016A: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_3424d3fe906d42b189bccdcffc806c89
brfalse IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
call System.Void JcaiuMS9wV4LV3cZShs::SYwSjp6tuC(JcaiuMS9wV4LV3cZShs)
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_63e7935c917d4c28b66b8adb1c94c4fb
brtrue IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ret <null>
Module Name
Ljlgzhpyr.exe
Full Name
Ljlgzhpyr.exe
EntryPoint
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Scope Name
Ljlgzhpyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ljlgzhpyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_018E: ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
nop <null>
ldsfld qLTvYVSR7jtHijq3doE qLTvYVSR7jtHijq3doE::JAaS8HmSOg
call System.Byte[] qLTvYVSR7jtHijq3doE::SYwSjp6tuC(qLTvYVSR7jtHijq3doE)
stloc.s V_1
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_23d059419a084a0b8d577232b7b48839
brfalse IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0117,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 -1824795971
ldc.i4 -1824795971
ldc.i4 971877187
xor <null>
ldc.i4 -235902517
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_1e13e15e11334b17ad11e7f30ad2ce7c
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
ldc.i4 1356706430
ldc.i4 -853866393
add <null>
ldc.i4 173283261
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_0543f64aa27f43b7ad599f485cea0272
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
newobj System.Void LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K::.ctor(System.String,System.String)
newobj System.Void AP9T3wbMkmYyJHbMaNL.eoBk1lbJgXL9T29geqF::.ctor(LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K)
ldloc.s V_1
ldsfld RD8NP7SltTpT6tdN0S2 RD8NP7SltTpT6tdN0S2::fteSzD4xlP
call System.Void RD8NP7SltTpT6tdN0S2::SYwSjp6tuC(System.Object,System.Byte[],RD8NP7SltTpT6tdN0S2)
ldc.i4 1
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_00e804e97f864ab48824aad52de94d84
brtrue IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0117,IL_0096)
leave IL_01B7: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_6bcb9c28eec9409cbf68941011f05779
brfalse IL_014E: switch(IL_016A)
pop <null>
ldc.i4 2
br IL_014E: switch(IL_016A)
br IL_014A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014A: ldloc V_0
br IL_016A: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_3424d3fe906d42b189bccdcffc806c89
brfalse IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
call System.Void JcaiuMS9wV4LV3cZShs::SYwSjp6tuC(JcaiuMS9wV4LV3cZShs)
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_63e7935c917d4c28b66b8adb1c94c4fb
brtrue IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ret <null>
5500207c170d4ba2cdb301ec87a2db6a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aOHUJ1dfGA65G1VO17.7Stk07JmvZSnyelrmw
n7Siswy255UKLcGWhi.yuRSQiExMJtHF5R7OO
NUt1auMV2XXjF5XEmG.P4OQsxQvZn5D9Pt6PX
l1Mgsnkwa5kMxJbwPM.LZM6hib27iy7HO1g18
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙