Malicious
Malicious

64a936901f37172576da174b85cf0e8b

Share on LinkedIn
Print
PE Executable
MD5: 64a936901f37172576da174b85cf0e8b
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 64a936901f37172576da174b85cf0e8b
Sha1 0aa645641053f731c2cea2ed7f1d16cf9046ca15
Sha256 78ce74d34c1d16e2b11f9823c7b43a8b32015d26e9f59354e80cc50d394ab0cb
Sha384 d04496108452fc34a9058935b7df6ff0d284517d2ad1c6d6cecb9a44e09a6b8a1c50eb9de9e0ef4c3668dce27fd857dd
Sha512 ac11c32c89958c6adb86b24a3ebad3a6726d2dcf6f92c11e73dd07e5904edb80d48ac21490fb1c827a5036e400dd1571bdf34241b41206f465aab0bdf6aa95b8
SSDeep 12288:XQXLFojVOFdHB9sI7/TuYc36aA/ozj+K27MULVnGD:yFojVOFdHoI7/TuYcK7ZAs
TLSH B305AE3B72918F21C24A1372C1C7590197AAD64776EBFB0B35C403D61A433FEDA4A69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
64a936901f37172576da174b85cf0e8b
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
THGWUW6u3jifwZEH4y.1xtlxBckaWyTIHyr1n
1LkeD1JgSFsAQLwKIu.LNe7O9G1PToKYq128C
vV9uiZPlCkaE1McwR1.0eMCfGdy8L6Vs35Ho7
ldoJl7s70HPNQgDTqS.HGQNQH03GBJg8wUQfL
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Xeimf.exe
Full Name
Xeimf.exe
EntryPoint
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Scope Name
Xeimf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xeimf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
call System.Void aXVkALRJLop3OsLLjU2::wAPRULVdmK(aXVkALRJLop3OsLLjU2)
ldc.i4 5
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_05cd8133632640aca8130a32431fc4f3
brtrue IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
nop <null>
ldsfld emjLYSRPDtJoWJfW2p5 emjLYSRPDtJoWJfW2p5::DM5Rdaks0F
call System.Byte[] emjLYSRPDtJoWJfW2p5::wAPRULVdmK(emjLYSRPDtJoWJfW2p5)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_c85b5c5a6ca34404bf1faab94c5af5c4
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_00BF: ldc.i4 1019848019
ldc.i4 1019848019
neg <null>
ldc.i4 -1188528767
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_e1ac327aea6c4842a8a8c45bd4ebf6f2
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
ldc.i4 2125827323
ldc.i4 1768475476
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_cb75f53cef874c59a512089185ec2be9
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
newobj System.Void xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld mLUC2PRCLRXDR0GK47t mLUC2PRCLRXDR0GK47t::d8pRiosWJc
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW mLUC2PRCLRXDR0GK47t::wAPRULVdmK(System.Object,System.Byte[],mLUC2PRCLRXDR0GK47t)
ldsfld vRqTfXRVtLhQ2RMYMjb vRqTfXRVtLhQ2RMYMjb::n8uRZCGAGo
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW vRqTfXRVtLhQ2RMYMjb::wAPRULVdmK(System.Object,vRqTfXRVtLhQ2RMYMjb)
ldsfld qH2793RXQyoo9hZ4kQS qH2793RXQyoo9hZ4kQS::uqWR7gIAja
call System.Void qH2793RXQyoo9hZ4kQS::wAPRULVdmK(System.Object,qH2793RXQyoo9hZ4kQS)
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bae75ae2b39449f4b982e924fe816aa1
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 2
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bcb9a87640f44095b99d30fc911871a8
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_2b17b3d4990d416295516319f2de9913
brfalse IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
ret <null>
Module Name
Xeimf.exe
Full Name
Xeimf.exe
EntryPoint
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Scope Name
Xeimf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Xeimf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void xEHh8PHOs3iEfceQpx.O2CRkaR6QrEM2rY1kt::lSqC54TDU()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
ldsfld aXVkALRJLop3OsLLjU2 aXVkALRJLop3OsLLjU2::uM2RGCXwIw
call System.Void aXVkALRJLop3OsLLjU2::wAPRULVdmK(aXVkALRJLop3OsLLjU2)
ldc.i4 5
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_05cd8133632640aca8130a32431fc4f3
brtrue IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
nop <null>
ldsfld emjLYSRPDtJoWJfW2p5 emjLYSRPDtJoWJfW2p5::DM5Rdaks0F
call System.Byte[] emjLYSRPDtJoWJfW2p5::wAPRULVdmK(emjLYSRPDtJoWJfW2p5)
stloc.s V_0
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_c85b5c5a6ca34404bf1faab94c5af5c4
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0144)
br IL_009B: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009B: ldloc V_2
br IL_00BF: ldc.i4 1019848019
ldc.i4 1019848019
neg <null>
ldc.i4 -1188528767
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_e1ac327aea6c4842a8a8c45bd4ebf6f2
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
ldc.i4 2125827323
ldc.i4 1768475476
xor <null>
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_cb75f53cef874c59a512089185ec2be9
xor <null>
ldsfld oXMxYHRRfotmewsKl6v oXMxYHRRfotmewsKl6v::XHrRHGCWXJ
call System.String oXMxYHRRfotmewsKl6v::wAPRULVdmK(System.Int32,oXMxYHRRfotmewsKl6v)
newobj System.Void xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld mLUC2PRCLRXDR0GK47t mLUC2PRCLRXDR0GK47t::d8pRiosWJc
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW mLUC2PRCLRXDR0GK47t::wAPRULVdmK(System.Object,System.Byte[],mLUC2PRCLRXDR0GK47t)
ldsfld vRqTfXRVtLhQ2RMYMjb vRqTfXRVtLhQ2RMYMjb::n8uRZCGAGo
call xLlAA2sYC42TxIqghPb.MM0HQrsU4Z2N5G7okkW vRqTfXRVtLhQ2RMYMjb::wAPRULVdmK(System.Object,vRqTfXRVtLhQ2RMYMjb)
ldsfld qH2793RXQyoo9hZ4kQS qH2793RXQyoo9hZ4kQS::uqWR7gIAja
call System.Void qH2793RXQyoo9hZ4kQS::wAPRULVdmK(System.Object,qH2793RXQyoo9hZ4kQS)
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bae75ae2b39449f4b982e924fe816aa1
brtrue IL_009F: switch(IL_00BF,IL_0144)
pop <null>
ldc.i4 2
br IL_009F: switch(IL_00BF,IL_0144)
leave IL_01BB: ret
pop <null>
ldc.i4 0
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_bcb9a87640f44095b99d30fc911871a8
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_01BB
leave IL_01BB: ret
ldc.i4 1
ldsfld <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786} <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_ebb131c9e457479690936a77b332a31d
ldfld System.Int32 <Module>{10b75883-d9ae-43c8-a687-1d8ef7b75786}::m_2b17b3d4990d416295516319f2de9913
brfalse IL_0014: switch(IL_01BB,IL_0061,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_01BB,IL_0061,IL_0038)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙