Deep Malware Analysis of 5a5ac9624714a1a27abac8221dabd3b3 | md5: 5a5ac9624714a1a27abac8221dabd3b3 | Html | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | SVG | .Net | Win 32 Exe | x86 | SOS: 0.13 | T1059.001 | T1059.007 | PowerShell | T1105 | PDB Path | SOS: 0.25 | SOS: 0.23 | SOS: 0.35

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.95 MB · 1,954,304 B

Hashes

MD5 5a5ac9624714a1a27abac8221dabd3b3 Sha1 334cfc35655efcacad3ceab311e52b1181ac44a0 Sha256 ad6484135f0edf919f0e145d417b2a21f08b8ee3dd8dae2c6eb7259f36630b6c Sha384 0f366154d7b507511b8dc23fd2941afea9629740913d8b036585cd7cec01f410a3abbfdff930c7223ea1ba358ba7411d Sha512 16a37f8d174f8e4956a6a92cee376463e9defc35e9d3deb26bd131b3a88d299c4bad95824f3b6f8110c0a61445c035f5487406831caa802cfb5622bd9aa68aab SSDeep 24576:jJ4dCXzRKX4EcJAD1RGQVIfSjjpE8rrn8WcyH:jJOcKjDnTc TLSH C695D81B5BEC411EE4B3A774557771105FFDBAAB3639CA0E358C502A8F62A41CDB2322

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Very low

6 malicious · 55 files

EXE5a5ac9624714a1a27abac8221dabd3b3

Structure

IMG0x00102507.svg

IMG0x00126D1B.svg

IMG0x0012C979.svg

IMG0x00143D32.svg

IMG0x0014425D.svg

IMG0x0014461C.svg

IMG0x001449E5.svg

BINResources

BIN.Net Resources

BINpayload

DLLMicrosoft.Web.WebView2.Core.dll

DLLMicrosoft.Web.WebView2.WinForms.dll

DLLWebView2Loader.dll

EXEYuDun.exe

BINapp

HTMindex.html

IMGpay-qr.png

BINcss

BINjs

JSapp.js

JScloud.js

JSengine.js

PS1[PowerShell Command]

JSsignatures.js

PS1[PowerShell Command]

BINvendor

BINsigs

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 12 STICH kept: 4secondary ignored: 8

bin 6img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>scr:js~T1059.001~T1059.007~T1105>scr:ps1~T1059.001~T1105

Shape pe:exe>scr:js>scr:ps1

malicious 3 nodes

Path pe:exe>scr:js~T1059.001~T1059.007>scr:ps1~T1059.001

Shape pe:exe>scr:js>scr:ps1

malicious 3 nodes

Config. Field	Value
URL in PowerShell #1	http:/huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	DomainShieldSetup.exe
Full Name	DomainShieldSetup.exe
EntryPoint	System.Void YuDunSetup.Program::Main()
Scope Name	DomainShieldSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DomainShieldSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	32
Main Method	System.Void YuDunSetup.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void YuDunSetup.InstallForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`
Module Name	DomainShieldSetup.exe
Full Name	DomainShieldSetup.exe
EntryPoint	System.Void YuDunSetup.Program::Main()
Scope Name	DomainShieldSetup.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DomainShieldSetup
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	32
Main Method	System.Void YuDunSetup.Program::Main()
Main IL Instruction Count	6
Main IL	`call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void YuDunSetup.InstallForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>`

URL in PowerShell #1 URImalicious

http:/huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential