Malicious
Malicious

5ad5d64e25beff6be8423d19e6a567ff

Share on LinkedIn
Print
PE Executable
MD5: 5ad5d64e25beff6be8423d19e6a567ff
Size: 1.6 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 5ad5d64e25beff6be8423d19e6a567ff
Sha1 bf99a10cbaabf06c0e6da3185a1165824a2ab41d
Sha256 e64817634cef6c13dd4eefbc89a04ce75eaa3bdc9dedd4cd19f41ddb39f3483c
Sha384 a5256ec81d35c509e407a0b721214b3e152e82cc997d8bdb2877d06e056e51601a0821d8e9ed4a8db6004cb622253911
Sha512 8bf84fa98e9efdc761aeb7b829a4a6f8e642611b7e40dec37f87cfa64426699a6ccb37fb6a4be261b011925d0fad11c2de58e4d7a3a72511719778e8161d9b66
SSDeep 24576:ToaXd3Fk0roKX8cf8jyJHUosKOHD2a3WE05cRCx1DyfO9OPffOwAIvdFJ2t:ToaXd3FkLfcfrULD2JQCmGIvJc
TLSH EF75BEAD39C5F8AED4138971C9A0FDB197106CA6C307D20395933DDBB93CA869F150EA
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
5ad5d64e25beff6be8423d19e6a567ff
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
kM.i2.resources
pa5.Naf.resources
$this.Icon
[NBF]root.IconData
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
AlpinePasture.Properties.Resources.resources
KL
[NBF]root.Data
bIYA
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Name Value
Module Name
vTdq.exe
Full Name
vTdq.exe
EntryPoint
System.Void NiQ.Qig::bin()
Scope Name
vTdq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vTdq
Assembly Version
2.0.1.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Info
PE Detect: PeReader OK (file layout)
Total Strings
3
Main Method
System.Void NiQ.Qig::bin()
Main IL Instruction Count
66
Main IL 
br IL_00FE: nop
ldc.i4 623434642
ldc.i4 811663254
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 13
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0109: br.s IL_00F2
ldloc.0 <null>
ldc.i4 -600249792
mul <null>
ldc.i4 1099692603
xor <null>
br.s IL_000A: ldc.i4 811663254
ldloc.0 <null>
ldc.i4 -1790740704
mul <null>
ldc.i4 -1956170821
xor <null>
br.s IL_000A: ldc.i4 811663254
nop <null>
ldc.i4.0 <null>
call System.Void NiQ.Qig::‍‮‏‍‭‬‎‭‎‌‭‫‮‏‪​‍‭‍​‏‌‭‮(System.Boolean)
ldc.i4 2011135171
br.s IL_000A: ldc.i4 811663254
call System.Void NiQ.Qig::‮​‏‪‌‏‎‮‮‮‍‪‌‭​‌‪‬‭‌‌‮‮()
ldloc.0 <null>
ldc.i4 708225053
mul <null>
ldc.i4 2072041922
xor <null>
br IL_000A: ldc.i4 811663254
ldloc.0 <null>
ldc.i4 -331082604
mul <null>
ldc.i4 -1777542178
xor <null>
br IL_000A: ldc.i4 811663254
ldsfld kM.i2 NiQ.Qig::ay3
call System.Void NiQ.Qig::‬‍‭‌‪‍‮‭‭‍‬‫‍‫‮‌‭‍​‎​​​‮‪‌‬‎‮(System.Windows.Forms.Form)
ldc.i4 1733639427
br IL_000A: ldc.i4 811663254
nop <null>
ldc.i4 1812235562
br IL_000A: ldc.i4 811663254
newobj System.Void kM.i2::.ctor()
stsfld kM.i2 NiQ.Qig::ay3
ldloc.0 <null>
ldc.i4 -449198125
mul <null>
ldc.i4 -1760819447
xor <null>
br IL_000A: ldc.i4 811663254
call System.Void CyZ.ByU::whM()
ldc.i4 886350542
br IL_000A: ldc.i4 811663254
nop <null>
ret <null>
ldc.i4 1939213435
br IL_000A: ldc.i4 811663254
nop <null>
ldc.i4 516661503
br IL_000A: ldc.i4 811663254
br.s IL_00F2: nop
Module Name
vTdq.exe
Full Name
vTdq.exe
EntryPoint
System.Void NiQ.Qig::bin()
Scope Name
vTdq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
vTdq
Assembly Version
2.0.1.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
3
Main Method
System.Void NiQ.Qig::bin()
Main IL Instruction Count
66
Main IL 
br IL_00FE: nop
ldc.i4 623434642
ldc.i4 811663254
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 13
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0109: br.s IL_00F2
ldloc.0 <null>
ldc.i4 -600249792
mul <null>
ldc.i4 1099692603
xor <null>
br.s IL_000A: ldc.i4 811663254
ldloc.0 <null>
ldc.i4 -1790740704
mul <null>
ldc.i4 -1956170821
xor <null>
br.s IL_000A: ldc.i4 811663254
nop <null>
ldc.i4.0 <null>
call System.Void NiQ.Qig::‍‮‏‍‭‬‎‭‎‌‭‫‮‏‪​‍‭‍​‏‌‭‮(System.Boolean)
ldc.i4 2011135171
br.s IL_000A: ldc.i4 811663254
call System.Void NiQ.Qig::‮​‏‪‌‏‎‮‮‮‍‪‌‭​‌‪‬‭‌‌‮‮()
ldloc.0 <null>
ldc.i4 708225053
mul <null>
ldc.i4 2072041922
xor <null>
br IL_000A: ldc.i4 811663254
ldloc.0 <null>
ldc.i4 -331082604
mul <null>
ldc.i4 -1777542178
xor <null>
br IL_000A: ldc.i4 811663254
ldsfld kM.i2 NiQ.Qig::ay3
call System.Void NiQ.Qig::‬‍‭‌‪‍‮‭‭‍‬‫‍‫‮‌‭‍​‎​​​‮‪‌‬‎‮(System.Windows.Forms.Form)
ldc.i4 1733639427
br IL_000A: ldc.i4 811663254
nop <null>
ldc.i4 1812235562
br IL_000A: ldc.i4 811663254
newobj System.Void kM.i2::.ctor()
stsfld kM.i2 NiQ.Qig::ay3
ldloc.0 <null>
ldc.i4 -449198125
mul <null>
ldc.i4 -1760819447
xor <null>
br IL_000A: ldc.i4 811663254
call System.Void CyZ.ByU::whM()
ldc.i4 886350542
br IL_000A: ldc.i4 811663254
nop <null>
ret <null>
ldc.i4 1939213435
br IL_000A: ldc.i4 811663254
nop <null>
ldc.i4 516661503
br IL_000A: ldc.i4 811663254
br.s IL_00F2: nop
An error has occurred. This application may no longer respond until reloaded. Reload 🗙