Malicious
Malicious

591ccc6f0dce1ed645ad4ae9720f3430

PE Executable
MD5: 591ccc6f0dce1ed645ad4ae9720f3430
Size: 428.03 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 591ccc6f0dce1ed645ad4ae9720f3430
Sha1 996c03c098e19492b4cd8dc18311e206cd4b1f79
Sha256 f636ff2834f3f113d068225ba9fa1465aa6211c183ef9b10a043382bce6bff3b
Sha384 5303512899951219cb7b7e9647974af6f602c2cd80fe0e6c4b68d370d4d9046393b6ff2c88de904c2b01ac9ffad4a233
Sha512 0248b4e7d33909d3d645e6633d8e57a9b45c80cb377da377c83dd094764e82247155feafa62f16e404e3a8124658099ce032d54e151f5a864bbd4903eeb16e44
SSDeep 6144:/AEn7BTsa75Z6k7m38r27nYI44aG1pGnT6f3f:IE78867QMYnuf
TLSH 9E944B3A36918F21D14A5372C1C7491093E6964736ABF70B328913D61E833FFDA4A79B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
591ccc6f0dce1ed645ad4ae9720f3430
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
M019ckh2oJd4p62Txp.Rq3pfFeVmwrXUqSwtN
ul6QkdnleN6niLKjno.uAodKNB0Ch4ro6YNCo
BvnK0WvjLbpCMeR1qs.nkmxGoPetDevLyueYo
6iFlo7ROojEW3FS7Gg.KKYBSpHZd7OQjni477
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qxavwhgt.exe
Full Name
Qxavwhgt.exe
EntryPoint
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Scope Name
Qxavwhgt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qxavwhgt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld b2O4p3cnOrgAg88aywt b2O4p3cnOrgAg88aywt::EhmcBFuXBa
call System.Void b2O4p3cnOrgAg88aywt::NcRcDZrTaM(b2O4p3cnOrgAg88aywt)
ldc.i4 6
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_e9c12124b7074a27ba8eb64c1b0eebb8
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld PNcJWRchnQPq4WH9wCO PNcJWRchnQPq4WH9wCO::SEqcetrPt1
call System.Byte[] PNcJWRchnQPq4WH9wCO::NcRcDZrTaM(PNcJWRchnQPq4WH9wCO)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_69989a8457a94998b898d14b06c119b0
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014B,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014B: leave IL_0061
ldc.i4 2009184149
ldc.i4 -34181588
add <null>
ldc.i4 1911681378
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_a813ffc046c14822abd0784a9cba0a55
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
ldc.i4 -1563156156
not <null>
ldc.i4 1350223576
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_9e171d1cfbde4a49b60b81fa4af623d5
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
newobj System.Void ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iyIfPncj2gbeLFEW4Jp iyIfPncj2gbeLFEW4Jp::TWbcdPe5oM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY iyIfPncj2gbeLFEW4Jp::NcRcDZrTaM(System.Object,System.Byte[],iyIfPncj2gbeLFEW4Jp)
ldsfld AE82KgcrLYj2U3fABgh AE82KgcrLYj2U3fABgh::Cvdc47hukM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY AE82KgcrLYj2U3fABgh::NcRcDZrTaM(System.Object,AE82KgcrLYj2U3fABgh)
ldsfld FfCZc8c9jqBtFJ7jkOg FfCZc8c9jqBtFJ7jkOg::Y6TcAviOxt
call System.Void FfCZc8c9jqBtFJ7jkOg::NcRcDZrTaM(System.Object,FfCZc8c9jqBtFJ7jkOg)
ldc.i4 0
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_7afcda40005d43dd91a1c305089f2f90
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014B,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_12c4047a425b49c292c4a3a415e43d86
brfalse IL_0182: switch(IL_019E)
pop <null>
ldc.i4 0
br IL_0182: switch(IL_019E)
br IL_017E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017E: ldloc V_1
br IL_019E: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_3ffac671d4514709bddc7f9a5546444e
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Qxavwhgt.exe
Full Name
Qxavwhgt.exe
EntryPoint
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Scope Name
Qxavwhgt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qxavwhgt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld b2O4p3cnOrgAg88aywt b2O4p3cnOrgAg88aywt::EhmcBFuXBa
call System.Void b2O4p3cnOrgAg88aywt::NcRcDZrTaM(b2O4p3cnOrgAg88aywt)
ldc.i4 6
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_e9c12124b7074a27ba8eb64c1b0eebb8
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld PNcJWRchnQPq4WH9wCO PNcJWRchnQPq4WH9wCO::SEqcetrPt1
call System.Byte[] PNcJWRchnQPq4WH9wCO::NcRcDZrTaM(PNcJWRchnQPq4WH9wCO)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_69989a8457a94998b898d14b06c119b0
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014B,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014B: leave IL_0061
ldc.i4 2009184149
ldc.i4 -34181588
add <null>
ldc.i4 1911681378
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_a813ffc046c14822abd0784a9cba0a55
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
ldc.i4 -1563156156
not <null>
ldc.i4 1350223576
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_9e171d1cfbde4a49b60b81fa4af623d5
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
newobj System.Void ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iyIfPncj2gbeLFEW4Jp iyIfPncj2gbeLFEW4Jp::TWbcdPe5oM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY iyIfPncj2gbeLFEW4Jp::NcRcDZrTaM(System.Object,System.Byte[],iyIfPncj2gbeLFEW4Jp)
ldsfld AE82KgcrLYj2U3fABgh AE82KgcrLYj2U3fABgh::Cvdc47hukM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY AE82KgcrLYj2U3fABgh::NcRcDZrTaM(System.Object,AE82KgcrLYj2U3fABgh)
ldsfld FfCZc8c9jqBtFJ7jkOg FfCZc8c9jqBtFJ7jkOg::Y6TcAviOxt
call System.Void FfCZc8c9jqBtFJ7jkOg::NcRcDZrTaM(System.Object,FfCZc8c9jqBtFJ7jkOg)
ldc.i4 0
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_7afcda40005d43dd91a1c305089f2f90
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014B,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_12c4047a425b49c292c4a3a415e43d86
brfalse IL_0182: switch(IL_019E)
pop <null>
ldc.i4 0
br IL_0182: switch(IL_019E)
br IL_017E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017E: ldloc V_1
br IL_019E: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_3ffac671d4514709bddc7f9a5546444e
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
591ccc6f0dce1ed645ad4ae9720f3430
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
M019ckh2oJd4p62Txp.Rq3pfFeVmwrXUqSwtN
ul6QkdnleN6niLKjno.uAodKNB0Ch4ro6YNCo
BvnK0WvjLbpCMeR1qs.nkmxGoPetDevLyueYo
6iFlo7ROojEW3FS7Gg.KKYBSpHZd7OQjni477
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙