Malicious
Malicious

64a936901f37172576da174b85cf0e8b

PE Executable
MD5: 64a936901f37172576da174b85cf0e8b
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 64a936901f37172576da174b85cf0e8b
Sha1 0aa645641053f731c2cea2ed7f1d16cf9046ca15
Sha256 78ce74d34c1d16e2b11f9823c7b43a8b32015d26e9f59354e80cc50d394ab0cb
Sha384 d04496108452fc34a9058935b7df6ff0d284517d2ad1c6d6cecb9a44e09a6b8a1c50eb9de9e0ef4c3668dce27fd857dd
Sha512 ac11c32c89958c6adb86b24a3ebad3a6726d2dcf6f92c11e73dd07e5904edb80d48ac21490fb1c827a5036e400dd1571bdf34241b41206f465aab0bdf6aa95b8
SSDeep 12288:XQXLFojVOFdHB9sI7/TuYc36aA/ozj+K27MULVnGD:yFojVOFdHoI7/TuYcK7ZAs
TLSH B305AE3B72918F21C24A1372C1C7590197AAD64776EBFB0B35C403D61A433FEDA4A69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
64a936901f37172576da174b85cf0e8b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
THGWUW6u3jifwZEH4y.1xtlxBckaWyTIHyr1n
1LkeD1JgSFsAQLwKIu.LNe7O9G1PToKYq128C
vV9uiZPlCkaE1McwR1.0eMCfGdy8L6Vs35Ho7
ldoJl7s70HPNQgDTqS.HGQNQH03GBJg8wUQfL
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Xeimf.exe
Full Name
Xeimf.exe
EntryPoint
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Scope Name
Xeimf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xeimf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
call System.Void aXVkALRJLop3OsLLjU2::wAPRULVdmK(aXVkALRJLop3OsLLjU2)
ldc.i4 5
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_05cd8133632640aca8130a32431fc4f3
brtrue IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
nop <null>
ldsfld emjLYSRPDtJoWJfW2p5 emjLYSRPDtJoWJfW2p5::DM5Rdaks0F
call System.Byte[] emjLYSRPDtJoWJfW2p5::wAPRULVdmK(emjLYSRPDtJoWJfW2p5)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_c85b5c5a6ca34404bf1faab94c5af5c4
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_00BF: ldc.i4 1019848019
ldc.i4 1019848019
neg <null>
ldc.i4 -1188528767
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_e1ac327aea6c4842a8a8c45bd4ebf6f2
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
ldc.i4 2125827323
ldc.i4 1768475476
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_cb75f53cef874c59a512089185ec2be9
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
newobj System.Void xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld mLUC2PRCLRXDR0GK47t mLUC2PRCLRXDR0GK47t::d8pRiosWJc
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW mLUC2PRCLRXDR0GK47t::wAPRULVdmK(System.Object,System.Byte[],mLUC2PRCLRXDR0GK47t)
ldsfld vRqTfXRVtLhQ2RMYMjb vRqTfXRVtLhQ2RMYMjb::n8uRZCGAGo
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW vRqTfXRVtLhQ2RMYMjb::wAPRULVdmK(System.Object,vRqTfXRVtLhQ2RMYMjb)
ldsfld qH2793RXQyoo9hZ4kQS qH2793RXQyoo9hZ4kQS::uqWR7gIAja
call System.Void qH2793RXQyoo9hZ4kQS::wAPRULVdmK(System.Object,qH2793RXQyoo9hZ4kQS)
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bae75ae2b39449f4b982e924fe816aa1
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 2
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bcb9a87640f44095b99d30fc911871a8
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_2b17b3d4990d416295516319f2de9913
brfalse IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
ret <null>
Module Name
Xeimf.exe
Full Name
Xeimf.exe
EntryPoint
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Scope Name
Xeimf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xeimf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
call System.Void aXVkALRJLop3OsLLjU2::wAPRULVdmK(aXVkALRJLop3OsLLjU2)
ldc.i4 5
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_05cd8133632640aca8130a32431fc4f3
brtrue IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
nop <null>
ldsfld emjLYSRPDtJoWJfW2p5 emjLYSRPDtJoWJfW2p5::DM5Rdaks0F
call System.Byte[] emjLYSRPDtJoWJfW2p5::wAPRULVdmK(emjLYSRPDtJoWJfW2p5)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_c85b5c5a6ca34404bf1faab94c5af5c4
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_00BF: ldc.i4 1019848019
ldc.i4 1019848019
neg <null>
ldc.i4 -1188528767
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_e1ac327aea6c4842a8a8c45bd4ebf6f2
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
ldc.i4 2125827323
ldc.i4 1768475476
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_cb75f53cef874c59a512089185ec2be9
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
newobj System.Void xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld mLUC2PRCLRXDR0GK47t mLUC2PRCLRXDR0GK47t::d8pRiosWJc
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW mLUC2PRCLRXDR0GK47t::wAPRULVdmK(System.Object,System.Byte[],mLUC2PRCLRXDR0GK47t)
ldsfld vRqTfXRVtLhQ2RMYMjb vRqTfXRVtLhQ2RMYMjb::n8uRZCGAGo
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW vRqTfXRVtLhQ2RMYMjb::wAPRULVdmK(System.Object,vRqTfXRVtLhQ2RMYMjb)
ldsfld qH2793RXQyoo9hZ4kQS qH2793RXQyoo9hZ4kQS::uqWR7gIAja
call System.Void qH2793RXQyoo9hZ4kQS::wAPRULVdmK(System.Object,qH2793RXQyoo9hZ4kQS)
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bae75ae2b39449f4b982e924fe816aa1
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 2
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bcb9a87640f44095b99d30fc911871a8
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_2b17b3d4990d416295516319f2de9913
brfalse IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
ret <null>
64a936901f37172576da174b85cf0e8b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
THGWUW6u3jifwZEH4y.1xtlxBckaWyTIHyr1n
1LkeD1JgSFsAQLwKIu.LNe7O9G1PToKYq128C
vV9uiZPlCkaE1McwR1.0eMCfGdy8L6Vs35Ho7
ldoJl7s70HPNQgDTqS.HGQNQH03GBJg8wUQfL
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙