618eb6e17478a6c5b6780aec0697e9b1

PE Executable

MD5: 618eb6e17478a6c5b6780aec0697e9b1

Size: 841.22 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	618eb6e17478a6c5b6780aec0697e9b1
Sha1	5266d46a51eebf58091a098a17022864a01017a6
Sha256	5f8849d726446a436c7d56709246a2981039840a8222b362ff6ad3c55df2f878
Sha384	88fd93dc879a1ba0be549f43d0618892a65a07c988d14af55dd26b35828ac0c8fa84903ec1bd49e76e25bbb07ea3b6d6
Sha512	a49309ad6dc41aa255c60c12c4a0e2a455b3aa1c3df0edf23741ddd330e2a6fb81c666f76f7fc6f57eda923c19a78c33767c7eaad7c9496df1f4f6775db0ac06
SSDeep	12288:cWncFiej+YdLG3Tum07xl8mME70gJ4LGX03TPpqc3eVDXaAvMQ:chTaYg3KfX8mv0e4LGabpheVDdUQ
TLSH	3405AE1B36624F50C2894BB3C1AB950083A7A687B6E3F30FB18513A75D437EEDD46693

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Eqieelc.exe
Full Name	Eqieelc.exe
EntryPoint	System.Void dfoETRUjkYdA608gxZ.M15NHYhZyMAvIacjoG::rmDYl2ZNW()
Scope Name	Eqieelc.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Eqieelc
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void dfoETRUjkYdA608gxZ.M15NHYhZyMAvIacjoG::rmDYl2ZNW()
Main IL Instruction Count	96
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 990 beq IL_0010: ldloc V_3 br IL_0039: nop ret <null> nop <null> ldsfld S91a6Uh3X8SDcX5QZKK S91a6Uh3X8SDcX5QZKK::TbqhZP1H6m call System.Byte[] S91a6Uh3X8SDcX5QZKK::HcMhSXcb2T(S91a6Uh3X8SDcX5QZKK) stloc.s V_0 ldc.i4 6 ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6f25f288316e46f9a322f738ba685e3d brtrue IL_0077: switch(IL_0097,IL_010E) pop <null> ldc.i4 0 br IL_0077: switch(IL_0097,IL_010E) br IL_0073: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0073: ldloc V_2 br IL_010E: leave IL_0038 ldc.i4 -1251363375 not <null> ldc.i4 342340696 xor <null> ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_8984ffb17aff4cf1b3dc77c06462657e xor <null> ldsfld kSH9wVhiT5PYMFSYXXL kSH9wVhiT5PYMFSYXXL::nuKhFDGGLE call System.String kSH9wVhiT5PYMFSYXXL::HcMhSXcb2T(System.Int32,kSH9wVhiT5PYMFSYXXL) ldc.i4 -35969282 not <null> ldc.i4 1147741089 xor <null> ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_8987870ceb8b4b4485d1102f2e535eb6 xor <null> ldsfld kSH9wVhiT5PYMFSYXXL kSH9wVhiT5PYMFSYXXL::nuKhFDGGLE call System.String kSH9wVhiT5PYMFSYXXL::HcMhSXcb2T(System.Int32,kSH9wVhiT5PYMFSYXXL) newobj System.Void uMiwm1bIQhb6n7mowm.CDG6ZaReaj16Hs0ALh::.ctor(System.String,System.String) newobj System.Void oxcS9SaxHH6DcPSB4Bm.kHpSwtaps2UEL3wHh50::.ctor(uMiwm1bIQhb6n7mowm.CDG6ZaReaj16Hs0ALh) ldloc.s V_0 ldsfld CpI0Pxh8131UthSXoEs CpI0Pxh8131UthSXoEs::hc6hzw7A1F call System.Void CpI0Pxh8131UthSXoEs::HcMhSXcb2T(System.Object,System.Byte[],CpI0Pxh8131UthSXoEs) ldc.i4 1 ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_16d5b0b1288b455eb17c9998d6ece94c brfalse IL_0077: switch(IL_0097,IL_010E) pop <null> ldc.i4 6 br IL_0077: switch(IL_0097,IL_010E) leave IL_0038: ret pop <null> ldc.i4 0 ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_cb997c15ced54320a500e1f9ab2454b1 brtrue IL_0145: switch(IL_0161) pop <null> ldc.i4 4 br IL_0145: switch(IL_0161) br IL_0141: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0141: ldloc V_1 br IL_0161: leave IL_0038 leave IL_0038: ret ldc.i4 0 ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_a0178b60327f4277a620d67c87a21067 brfalse IL_0014: switch(IL_0039,IL_0185,IL_0038) pop <null> ldc.i4 2 br IL_0014: switch(IL_0039,IL_0185,IL_0038) ldsfld MPlheShXQRL4RRCmDH2 MPlheShXQRL4RRCmDH2::Nf0hdhD8gE call System.Void MPlheShXQRL4RRCmDH2::HcMhSXcb2T(MPlheShXQRL4RRCmDH2) ldc.i4 0 ldsfld <Module>{9fba32ba-c64b-49b1-8838-773c600c2883} <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6433d7cde06e4d3aa78baecdafca6d7e ldfld System.Int32 <Module>{9fba32ba-c64b-49b1-8838-773c600c2883}::m_6f25f288316e46f9a322f738ba685e3d brfalse IL_0014: switch(IL_0039,IL_0185,IL_0038) pop <null> ldc.i4 7 br IL_0014: switch(IL_0039,IL_0185,IL_0038)

No malware configuration was found at this point.

You must be signed in to view YARA rules.