Suspicious
Suspect

60acb8a1e8635a7c9efd915dbac5244e

Share on LinkedIn
Print
PE Executable
MD5: 60acb8a1e8635a7c9efd915dbac5244e
Size: 1.28 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 60acb8a1e8635a7c9efd915dbac5244e
Sha1 373bbaf0201d879751805397e1da2d2e50685e1e
Sha256 2c79fb665363367820fcb7f0373992d69b8bb0ae35776274e1f211ed80f8a208
Sha384 755f10788900e24fbaf90fae7f8f7a2d05886d29b3b15dc27d0710f62aa397962ce54d0d610c5641060e6172d12292cc
Sha512 1c6a88beff7eb73e518d0c1d3c52f581eb785f84c52e7cd0a1f4b8851b860d4740394fa931786783698e01027d39089afd8ddbedf5c5cd925893e6616cd87641
SSDeep 24576:AG0L2MhgqlgQMFpl9xeAUhQzi5IO7hL4A:t9Meqlg9Fpl9+QzmHhLf
TLSH DD45E04113E89F58F8BFAB3C5478142047F7BC46DE35D7BE2A5898AD2872B81CA51723
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
60acb8a1e8635a7c9efd915dbac5244e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Tafinobix.kbfida.levi
6feHjWt75.Resources.resources
698d1cb1640583.Resources.resources
2e9890000
[NBF]root.Data
2e9890001
[NBF]root.Data
2e98900010
[NBF]root.Data
2e98900011
[NBF]root.Data
2e98900012
[NBF]root.Data
2e98900013
[NBF]root.Data
2e98900014
[NBF]root.Data
2e98900015
[NBF]root.Data
2e98900016
[NBF]root.Data
2e98900017
[NBF]root.Data
2e98900018
[NBF]root.Data
2e98900019
[NBF]root.Data
2e9890002
[NBF]root.Data
2e98900020
[NBF]root.Data
2e98900021
[NBF]root.Data
2e98900022
[NBF]root.Data
2e98900023
[NBF]root.Data
2e98900024
[NBF]root.Data
2e9890003
[NBF]root.Data
2e9890004
[NBF]root.Data
2e9890005
[NBF]root.Data
2e9890006
[NBF]root.Data
2e9890007
[NBF]root.Data
2e9890008
[NBF]root.Data
2e9890009
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
6feHjWt75
Full Name
6feHjWt75
EntryPoint
System.Void 6feHjWt75.Gng2z7Pq3::k_3Pf1Rq8doKy()
Scope Name
6feHjWt75
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
6feHjWt75
Assembly Version
4.15.21.242
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Info
PE Detect: PeReader OK (file layout)
Total Strings
1399
Main Method
System.Void 6feHjWt75.Gng2z7Pq3::k_3Pf1Rq8doKy()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object 6feHjWt75.RenoLedger.5m_JtiX0Qn9/Wd6s9m.2Wcoqm1QP::Aib58tZwzMz3a1(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 6feHjWt75.Gng2z7Pq3::4EwxSaq1q9(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void 6feHjWt75.Gng2z7Pq3::6Psez(System.Object[],System.Int32)
nop <null>
ret <null>
Module Name
6feHjWt75
Full Name
6feHjWt75
EntryPoint
System.Void 6feHjWt75.Gng2z7Pq3::k_3Pf1Rq8doKy()
Scope Name
6feHjWt75
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
6feHjWt75
Assembly Version
4.15.21.242
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1399
Main Method
System.Void 6feHjWt75.Gng2z7Pq3::k_3Pf1Rq8doKy()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object 6feHjWt75.RenoLedger.5m_JtiX0Qn9/Wd6s9m.2Wcoqm1QP::Aib58tZwzMz3a1(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 6feHjWt75.Gng2z7Pq3::4EwxSaq1q9(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void 6feHjWt75.Gng2z7Pq3::6Psez(System.Object[],System.Int32)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙