Malicious
Malicious

591ccc6f0dce1ed645ad4ae9720f3430

Share on LinkedIn
Print
PE Executable
MD5: 591ccc6f0dce1ed645ad4ae9720f3430
Size: 428.03 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 591ccc6f0dce1ed645ad4ae9720f3430
Sha1 996c03c098e19492b4cd8dc18311e206cd4b1f79
Sha256 f636ff2834f3f113d068225ba9fa1465aa6211c183ef9b10a043382bce6bff3b
Sha384 5303512899951219cb7b7e9647974af6f602c2cd80fe0e6c4b68d370d4d9046393b6ff2c88de904c2b01ac9ffad4a233
Sha512 0248b4e7d33909d3d645e6633d8e57a9b45c80cb377da377c83dd094764e82247155feafa62f16e404e3a8124658099ce032d54e151f5a864bbd4903eeb16e44
SSDeep 6144:/AEn7BTsa75Z6k7m38r27nYI44aG1pGnT6f3f:IE78867QMYnuf
TLSH 9E944B3A36918F21D14A5372C1C7491093E6964736ABF70B328913D61E833FFDA4A79B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
591ccc6f0dce1ed645ad4ae9720f3430
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
M019ckh2oJd4p62Txp.Rq3pfFeVmwrXUqSwtN
ul6QkdnleN6niLKjno.uAodKNB0Ch4ro6YNCo
BvnK0WvjLbpCMeR1qs.nkmxGoPetDevLyueYo
6iFlo7ROojEW3FS7Gg.KKYBSpHZd7OQjni477
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qxavwhgt.exe
Full Name
Qxavwhgt.exe
EntryPoint
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Scope Name
Qxavwhgt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qxavwhgt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld b2O4p3cnOrgAg88aywt b2O4p3cnOrgAg88aywt::EhmcBFuXBa
call System.Void b2O4p3cnOrgAg88aywt::NcRcDZrTaM(b2O4p3cnOrgAg88aywt)
ldc.i4 6
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_e9c12124b7074a27ba8eb64c1b0eebb8
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld PNcJWRchnQPq4WH9wCO PNcJWRchnQPq4WH9wCO::SEqcetrPt1
call System.Byte[] PNcJWRchnQPq4WH9wCO::NcRcDZrTaM(PNcJWRchnQPq4WH9wCO)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_69989a8457a94998b898d14b06c119b0
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014B,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014B: leave IL_0061
ldc.i4 2009184149
ldc.i4 -34181588
add <null>
ldc.i4 1911681378
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_a813ffc046c14822abd0784a9cba0a55
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
ldc.i4 -1563156156
not <null>
ldc.i4 1350223576
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_9e171d1cfbde4a49b60b81fa4af623d5
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
newobj System.Void ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iyIfPncj2gbeLFEW4Jp iyIfPncj2gbeLFEW4Jp::TWbcdPe5oM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY iyIfPncj2gbeLFEW4Jp::NcRcDZrTaM(System.Object,System.Byte[],iyIfPncj2gbeLFEW4Jp)
ldsfld AE82KgcrLYj2U3fABgh AE82KgcrLYj2U3fABgh::Cvdc47hukM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY AE82KgcrLYj2U3fABgh::NcRcDZrTaM(System.Object,AE82KgcrLYj2U3fABgh)
ldsfld FfCZc8c9jqBtFJ7jkOg FfCZc8c9jqBtFJ7jkOg::Y6TcAviOxt
call System.Void FfCZc8c9jqBtFJ7jkOg::NcRcDZrTaM(System.Object,FfCZc8c9jqBtFJ7jkOg)
ldc.i4 0
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_7afcda40005d43dd91a1c305089f2f90
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014B,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_12c4047a425b49c292c4a3a415e43d86
brfalse IL_0182: switch(IL_019E)
pop <null>
ldc.i4 0
br IL_0182: switch(IL_019E)
br IL_017E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017E: ldloc V_1
br IL_019E: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_3ffac671d4514709bddc7f9a5546444e
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Qxavwhgt.exe
Full Name
Qxavwhgt.exe
EntryPoint
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Scope Name
Qxavwhgt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qxavwhgt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void dGRmdwo0980LyfjToa.dqfD5eccFniu3HPkhr::TvkjUqs2Y()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld b2O4p3cnOrgAg88aywt b2O4p3cnOrgAg88aywt::EhmcBFuXBa
call System.Void b2O4p3cnOrgAg88aywt::NcRcDZrTaM(b2O4p3cnOrgAg88aywt)
ldc.i4 6
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_e9c12124b7074a27ba8eb64c1b0eebb8
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld PNcJWRchnQPq4WH9wCO PNcJWRchnQPq4WH9wCO::SEqcetrPt1
call System.Byte[] PNcJWRchnQPq4WH9wCO::NcRcDZrTaM(PNcJWRchnQPq4WH9wCO)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_69989a8457a94998b898d14b06c119b0
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014B,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_014B: leave IL_0061
ldc.i4 2009184149
ldc.i4 -34181588
add <null>
ldc.i4 1911681378
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_a813ffc046c14822abd0784a9cba0a55
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
ldc.i4 -1563156156
not <null>
ldc.i4 1350223576
xor <null>
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_9e171d1cfbde4a49b60b81fa4af623d5
xor <null>
ldsfld dyE8qfcc3rkxrCRe20Z dyE8qfcc3rkxrCRe20Z::P28colZUTU
call System.String dyE8qfcc3rkxrCRe20Z::NcRcDZrTaM(System.Int32,dyE8qfcc3rkxrCRe20Z)
newobj System.Void ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld iyIfPncj2gbeLFEW4Jp iyIfPncj2gbeLFEW4Jp::TWbcdPe5oM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY iyIfPncj2gbeLFEW4Jp::NcRcDZrTaM(System.Object,System.Byte[],iyIfPncj2gbeLFEW4Jp)
ldsfld AE82KgcrLYj2U3fABgh AE82KgcrLYj2U3fABgh::Cvdc47hukM
call ahcyKIRSpqYlKEy6cGp.hZvQUhRDfcJ79kansbY AE82KgcrLYj2U3fABgh::NcRcDZrTaM(System.Object,AE82KgcrLYj2U3fABgh)
ldsfld FfCZc8c9jqBtFJ7jkOg FfCZc8c9jqBtFJ7jkOg::Y6TcAviOxt
call System.Void FfCZc8c9jqBtFJ7jkOg::NcRcDZrTaM(System.Object,FfCZc8c9jqBtFJ7jkOg)
ldc.i4 0
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_7afcda40005d43dd91a1c305089f2f90
brtrue IL_00A0: switch(IL_014B,IL_00C0)
pop <null>
ldc.i4 4
br IL_00A0: switch(IL_014B,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 5
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_12c4047a425b49c292c4a3a415e43d86
brfalse IL_0182: switch(IL_019E)
pop <null>
ldc.i4 0
br IL_0182: switch(IL_019E)
br IL_017E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017E: ldloc V_1
br IL_019E: leave IL_0061
leave IL_0061: ret
ldc.i4 2
ldsfld <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0} <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_24b104766b004f79b5ade8a6d8b5bc6d
ldfld System.Int32 <Module>{0d39d2e5-5d5f-425e-a6ef-53baa27ce7e0}::m_3ffac671d4514709bddc7f9a5546444e
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙