Malicious
Malicious

5500207c170d4ba2cdb301ec87a2db6a

Share on LinkedIn
Print
PE Executable
MD5: 5500207c170d4ba2cdb301ec87a2db6a
Size: 569.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5500207c170d4ba2cdb301ec87a2db6a
Sha1 e2dbaad6794722e575c9b43bf78a9ebc404c7a38
Sha256 321412c9e3b62d010fa039be0c56f2440910082abcf36597de697240ffba4011
Sha384 3a08695ee4febe0cbbeafc06392688505dcc155cb0a3a6f11d65b9cf09566e6e5a62e946282cc798c9690d99420f3095
Sha512 121dd6f7b0a93a6a10a9e965f14a96a3a73818c3969188b547822793757fd26516b07287a11974ea6d4685a865d17b5bd172ed4108665b02a5f9700317c0300f
SSDeep 12288:yW+0epmeEj2KqFXqZYyZicQBeNIPsqNV:V+rJFXqZDixeNIPz
TLSH 5DC45C1B36914E90C28457B7E1DB950083A2AA86F9E3F30FB28413A61D177FED947793
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5500207c170d4ba2cdb301ec87a2db6a
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aOHUJ1dfGA65G1VO17.7Stk07JmvZSnyelrmw
n7Siswy255UKLcGWhi.yuRSQiExMJtHF5R7OO
NUt1auMV2XXjF5XEmG.P4OQsxQvZn5D9Pt6PX
l1Mgsnkwa5kMxJbwPM.LZM6hib27iy7HO1g18
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ljlgzhpyr.exe
Full Name
Ljlgzhpyr.exe
EntryPoint
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Scope Name
Ljlgzhpyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ljlgzhpyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_018E: ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
nop <null>
ldsfld qLTvYVSR7jtHijq3doE qLTvYVSR7jtHijq3doE::JAaS8HmSOg
call System.Byte[] qLTvYVSR7jtHijq3doE::SYwSjp6tuC(qLTvYVSR7jtHijq3doE)
stloc.s V_1
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_23d059419a084a0b8d577232b7b48839
brfalse IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0117,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 -1824795971
ldc.i4 -1824795971
ldc.i4 971877187
xor <null>
ldc.i4 -235902517
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_1e13e15e11334b17ad11e7f30ad2ce7c
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
ldc.i4 1356706430
ldc.i4 -853866393
add <null>
ldc.i4 173283261
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_0543f64aa27f43b7ad599f485cea0272
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
newobj System.Void LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K::.ctor(System.String,System.String)
newobj System.Void AP9T3wbMkmYyJHbMaNL.eoBk1lbJgXL9T29geqF::.ctor(LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K)
ldloc.s V_1
ldsfld RD8NP7SltTpT6tdN0S2 RD8NP7SltTpT6tdN0S2::fteSzD4xlP
call System.Void RD8NP7SltTpT6tdN0S2::SYwSjp6tuC(System.Object,System.Byte[],RD8NP7SltTpT6tdN0S2)
ldc.i4 1
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_00e804e97f864ab48824aad52de94d84
brtrue IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0117,IL_0096)
leave IL_01B7: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_6bcb9c28eec9409cbf68941011f05779
brfalse IL_014E: switch(IL_016A)
pop <null>
ldc.i4 2
br IL_014E: switch(IL_016A)
br IL_014A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014A: ldloc V_0
br IL_016A: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_3424d3fe906d42b189bccdcffc806c89
brfalse IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
call System.Void JcaiuMS9wV4LV3cZShs::SYwSjp6tuC(JcaiuMS9wV4LV3cZShs)
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_63e7935c917d4c28b66b8adb1c94c4fb
brtrue IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ret <null>
Module Name
Ljlgzhpyr.exe
Full Name
Ljlgzhpyr.exe
EntryPoint
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Scope Name
Ljlgzhpyr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ljlgzhpyr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void gyikOHpf56f2X4nKea.OmeThQS0wxjrT8iO2X::iI5X6umMP()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_018E: ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
nop <null>
ldsfld qLTvYVSR7jtHijq3doE qLTvYVSR7jtHijq3doE::JAaS8HmSOg
call System.Byte[] qLTvYVSR7jtHijq3doE::SYwSjp6tuC(qLTvYVSR7jtHijq3doE)
stloc.s V_1
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_23d059419a084a0b8d577232b7b48839
brfalse IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0117,IL_0096)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 -1824795971
ldc.i4 -1824795971
ldc.i4 971877187
xor <null>
ldc.i4 -235902517
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_1e13e15e11334b17ad11e7f30ad2ce7c
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
ldc.i4 1356706430
ldc.i4 -853866393
add <null>
ldc.i4 173283261
xor <null>
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_0543f64aa27f43b7ad599f485cea0272
xor <null>
ldsfld dfV2NuSLhqPxD260hyT dfV2NuSLhqPxD260hyT::BZ4Si8ary8
call System.String dfV2NuSLhqPxD260hyT::SYwSjp6tuC(System.Int32,dfV2NuSLhqPxD260hyT)
newobj System.Void LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K::.ctor(System.String,System.String)
newobj System.Void AP9T3wbMkmYyJHbMaNL.eoBk1lbJgXL9T29geqF::.ctor(LQIdtLBU4y2DsFaRYK.KypUIeCmOkidy7eX9K)
ldloc.s V_1
ldsfld RD8NP7SltTpT6tdN0S2 RD8NP7SltTpT6tdN0S2::fteSzD4xlP
call System.Void RD8NP7SltTpT6tdN0S2::SYwSjp6tuC(System.Object,System.Byte[],RD8NP7SltTpT6tdN0S2)
ldc.i4 1
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_00e804e97f864ab48824aad52de94d84
brtrue IL_0076: switch(IL_0117,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0117,IL_0096)
leave IL_01B7: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_6bcb9c28eec9409cbf68941011f05779
brfalse IL_014E: switch(IL_016A)
pop <null>
ldc.i4 2
br IL_014E: switch(IL_016A)
br IL_014A: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014A: ldloc V_0
br IL_016A: leave IL_01B7
leave IL_01B7: ret
ldc.i4 0
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_3424d3fe906d42b189bccdcffc806c89
brfalse IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ldsfld JcaiuMS9wV4LV3cZShs JcaiuMS9wV4LV3cZShs::RLHSrAQXAo
call System.Void JcaiuMS9wV4LV3cZShs::SYwSjp6tuC(JcaiuMS9wV4LV3cZShs)
ldc.i4 3
ldsfld <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783} <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_cf8cbc25f547400ab2ab6c905ac716f5
ldfld System.Int32 <Module>{a7ec6d02-f942-4614-afc1-2aa0dcd23783}::m_63e7935c917d4c28b66b8adb1c94c4fb
brtrue IL_0014: switch(IL_01B7,IL_0038,IL_018E)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01B7,IL_0038,IL_018E)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙