Malicious
Malicious

5a5ac9624714a1a27abac8221dabd3b3

PE Executable
MD5: 5a5ac9624714a1a27abac8221dabd3b3
Size: 1.95 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.95 MB · 1,954,304 B
First seen
2026-10-24 06:30 · yesterday
Last seen
2026-10-24 06:30 · yesterday
Last analysis
2026-10-24 06:31 · yesterday
Hashes
MD5 5a5ac9624714a1a27abac8221dabd3b3 Sha1 334cfc35655efcacad3ceab311e52b1181ac44a0 Sha256 ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c Sha384 0f366154d7b507511b8dc23fd2941afea9629740913d8b036585cd7cec01f410a3abbfdff930c7223ea1ba358ba7411d Sha512 16a37f8d174f8e4956a6a92cee376463e9defc35e9d3deb26bd131b3a88d299c4bad95824f3b6f8110c0a61445c035f5487406831caa802cfb5622bd9aa68aab SSDeep 24576:jJ4dCXzRKX4EcJAD1RGQVIfSjjpE8rrn8WcyH:jJOcKjDnTc TLSH C695D81B5BEC411EE4B3A774557771105FFDBAAB3639CA0E358C502A8F62A41CDB2322
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Very low
6 malicious · 55 files
EXE5a5ac9624714a1a27abac8221dabd3b3
Structure
IMG0x00102507.svg
IMG0x00102507.svg-preview.jpg
IMG0x00126D1B.svg
IMG0x00126D1B.svg-preview.jpg
IMG0x0012C979.svg
IMG0x00143D32.svg
IMG0x00143D32.svg-preview.jpg
IMG0x0014425D.svg
IMG0x0014425D.svg-preview.jpg
IMG0x0014461C.svg
IMG0x0014461C.svg-preview.jpg
IMG0x001449E5.svg
IMG0x001449E5.svg-preview.jpg
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINpayload
DLLMicrosoft.Web.WebView2.Core.dll
Structure
P7B[Authenticode]_fa30d052.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
DLLMicrosoft.Web.WebView2.WinForms.dll
Structure
P7B[Authenticode]_36287edc.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BMPMicrosoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
DLLWebView2Loader.dll
Structure
P7B[Authenticode]_5688fb5a.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEYuDun.exe
Structure
BINResources
BINRT_ICON
BINID:0002
IMGID:0
IMGID:0-preview.png
BINID:0003
IMGID:0
IMGID:0-preview.png
BINID:0004
IMGID:0
IMGID:0-preview.png
BINID:0005
IMGID:0
IMGID:0-preview.png
BINID:0006
IMGID:0
IMGID:0-preview.png
BINID:0007
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
PFXlocalhost.pfx
BINapp
HTMindex.html
IMGpay-qr.png
IMGpay-qr.png-preview.png
BINcss
CSSstyles.css
BINjs
JSapp.js
JScloud.js
JSengine.js
PS1[PowerShell Command]
PS1[PowerShell Command]
JSsignatures.js
PS1[PowerShell Command]
BINvendor
JSlucide.min.js
BINsigs
JSONdb.json
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 12 STICH kept: 4secondary ignored: 8
bin 6img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>scr:js~T1059.001~T1059.007~T1105>scr:ps1~T1059.001~T1105
Shape pe:exe>scr:js>scr:ps1
malicious 3 nodes
Path pe:exe>scr:js~T1059.001~T1059.007>scr:ps1~T1059.001
Shape pe:exe>scr:js>scr:ps1
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
DomainShieldSetup.exe
Full Name
DomainShieldSetup.exe
EntryPoint
System.Void YuDunSetup.Program::Main()
Scope Name
DomainShieldSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DomainShieldSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
32
Main Method
System.Void YuDunSetup.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void YuDunSetup.InstallForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
DomainShieldSetup.exe
Full Name
DomainShieldSetup.exe
EntryPoint
System.Void YuDunSetup.Program::Main()
Scope Name
DomainShieldSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DomainShieldSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
32
Main Method
System.Void YuDunSetup.Program::Main()
Main IL Instruction Count
6
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void YuDunSetup.InstallForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6 malicious · 55 files
EXE5a5ac9624714a1a27abac8221dabd3b3
Structure
IMG0x0012C979.svg
BIN.Net Resources
BINpayload
BINapp
HTMindex.html
BINjs
JSapp.js
JScloud.js
JSengine.js
PS1[PowerShell Command]
PS1[PowerShell Command]
JSsignatures.js
PS1[PowerShell Command]
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhu
5a5ac9624714a1a27abac8221dabd3b3 › .Net Resources › payload › app › js › engine.js
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙