Suspicious
Suspect

64d46feb763648ce967002165a23a318

PE Executable
MD5: 64d46feb763648ce967002165a23a318
Size: 867.33 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 64d46feb763648ce967002165a23a318
Sha1 96bf7371d2728d6dedd7514b86eec3cd21f15c7b
Sha256 e3fe0ffb77b77d7279d08e0d2500b97548312f53d493999f7b329845bbd0d6e8
Sha384 7a011aed100905bf2c26ae37a942961a2ae1bb5da848838e998308667d632548a9922e748c8eade7ba34c28e868ad64b
Sha512 b72bd5b23e2809b5f43e60f7a209e9272db8aee7279f58c4217c4a595870508af9f9f7c2435ae6335d29bcba791c9c81fda25932254a6f563610ae5647f9da2f
SSDeep 12288:r7fdT/Jv64occwtS+sng7UywBPT5x7egmE9q1N9PswuYfxRag:3V/JyxwU+snmwBL5x7dm9PuYfx
TLSH A705022A37C917A4E9FEAB388574500657F1F806D732FA6E7D6C51FE0A31B809912723
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
64d46feb763648ce967002165a23a318
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
kr6LJba5n.g.resources
kr6LJba5n.Resources.resources
a7471dd259b381.Resources.resources
429641d30
[NBF]root.Data
429641d31
[NBF]root.Data
429641d310
[NBF]root.Data
429641d311
[NBF]root.Data
429641d312
[NBF]root.Data
429641d32
[NBF]root.Data
429641d33
[NBF]root.Data
429641d34
[NBF]root.Data
429641d35
[NBF]root.Data
429641d36
[NBF]root.Data
429641d37
[NBF]root.Data
429641d38
[NBF]root.Data
429641d39
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
kr6LJba5n
Full Name
kr6LJba5n
EntryPoint
System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Scope Name
kr6LJba5n
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kr6LJba5n
Assembly Version
3.5.38.257
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Info
PE Detect: PeReader OK (file layout)
Total Strings
571
Main Method
System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Main IL Instruction Count
169
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
ldc.i4.s 25
stloc.2 <null>
ldc.i4 2931804
box System.Int32
stloc.3 <null>
ldsfld System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/Ko1y9TxtSmk.He7wc0::5mnESi1f
stloc.s V_4
ldloc.s V_4
call System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/8MdeFc1.gRt4De1i6::Wg4_j0SytXw5x8(System.String)
stloc.s V_5
ldloc.s V_5
call System.Byte[] kr6LJba5n.sMa4x::Cm0k6EttMec38(System.String)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brfalse.s IL_0044: nop
ldstr GetA returned Nothing.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
ldloc.s V_6
ldloc.3 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
call System.Object kr6LJba5n.xRp7_2Fcr::Mgx67Xksm9k(System.Byte[],System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_7
ldloc.s V_7
ldnull <null>
ceq <null>
stloc.s V_14
ldloc.s V_14
brfalse.s IL_006F: nop
ldstr Encryption returned Nothing.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
ldloc.s V_7
ldnull <null>
ldstr ToArray
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Byte[]
stloc.s V_8
ldc.i4.3 <null>
stloc.s V_9
ldc.i4.7 <null>
stloc.0 <null>
nop <null>
ldloc.s V_9
ldc.i4.3 <null>
beq.s IL_009A: nop
br.s IL_00A1: nop
nop <null>
ldloc.s V_8
stloc.s V_10
br.s IL_00A1: nop
nop <null>
ldc.i4.s 9
stloc.0 <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_11
ldloc.s V_11
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods()
ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
brfalse.s IL_00C6: ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y
ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
br.s IL_00DC: call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>)
ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y
ldftn System.Boolean kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Woy3tZ2c6zpGF8(System.Reflection.MethodInfo)
newobj System.Void System.Func`2<System.Reflection.MethodInfo,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>)
call System.Reflection.MethodInfo[] System.Linq.Enumerable::ToArray<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>)
stloc.s V_12
ldloc.s V_12
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br IL_0190: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
nop <null>
ldloc.s V_17
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr GetTypes
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.s 25
box System.Int32
stelem.ref <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[])
ldnull <null>
ldstr GetMethods
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Int32
stelem.ref <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object kr6LJba5n.eTa6K::rC_0t9PsDp5db(System.Object)
pop <null>
leave.s IL_01A1: ldc.i4.4
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0188: nop
nop <null>
nop <null>
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_20
ldloc.s V_20
brtrue IL_00F4: ldloc.s V_15
ldc.i4.4 <null>
stloc.0 <null>
ret <null>
Module Name
kr6LJba5n
Full Name
kr6LJba5n
EntryPoint
System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Scope Name
kr6LJba5n
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
kr6LJba5n
Assembly Version
3.5.38.257
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
571
Main Method
System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Main IL Instruction Count
169
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
ldc.i4.s 25
stloc.2 <null>
ldc.i4 2931804
box System.Int32
stloc.3 <null>
ldsfld System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/Ko1y9TxtSmk.He7wc0::5mnESi1f
stloc.s V_4
ldloc.s V_4
call System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/8MdeFc1.gRt4De1i6::Wg4_j0SytXw5x8(System.String)
stloc.s V_5
ldloc.s V_5
call System.Byte[] kr6LJba5n.sMa4x::Cm0k6EttMec38(System.String)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ceq <null>
stloc.s V_13
ldloc.s V_13
brfalse.s IL_0044: nop
ldstr GetA returned Nothing.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
ldloc.s V_6
ldloc.3 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
call System.Object kr6LJba5n.xRp7_2Fcr::Mgx67Xksm9k(System.Byte[],System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_7
ldloc.s V_7
ldnull <null>
ceq <null>
stloc.s V_14
ldloc.s V_14
brfalse.s IL_006F: nop
ldstr Encryption returned Nothing.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
nop <null>
ldloc.s V_7
ldnull <null>
ldstr ToArray
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Byte[]
stloc.s V_8
ldc.i4.3 <null>
stloc.s V_9
ldc.i4.7 <null>
stloc.0 <null>
nop <null>
ldloc.s V_9
ldc.i4.3 <null>
beq.s IL_009A: nop
br.s IL_00A1: nop
nop <null>
ldloc.s V_8
stloc.s V_10
br.s IL_00A1: nop
nop <null>
ldc.i4.s 9
stloc.0 <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_11
ldloc.s V_11
callvirt System.Reflection.MethodInfo[] System.Type::GetMethods()
ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
brfalse.s IL_00C6: ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y
ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
br.s IL_00DC: call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>)
ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y
ldftn System.Boolean kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Woy3tZ2c6zpGF8(System.Reflection.MethodInfo)
newobj System.Void System.Func`2<System.Reflection.MethodInfo,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn
call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>)
call System.Reflection.MethodInfo[] System.Linq.Enumerable::ToArray<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>)
stloc.s V_12
ldloc.s V_12
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
br IL_0190: ldloc.s V_16
ldloc.s V_15
ldloc.s V_16
ldelem.ref <null>
stloc.s V_17
nop <null>
ldloc.s V_17
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_10
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr GetTypes
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.s 25
box System.Int32
stelem.ref <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[])
ldnull <null>
ldstr GetMethods
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
box System.Int32
stelem.ref <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object kr6LJba5n.eTa6K::rC_0t9PsDp5db(System.Object)
pop <null>
leave.s IL_01A1: ldc.i4.4
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0188: nop
nop <null>
nop <null>
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_20
ldloc.s V_20
brtrue IL_00F4: ldloc.s V_15
ldc.i4.4 <null>
stloc.0 <null>
ret <null>
64d46feb763648ce967002165a23a318
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
kr6LJba5n.g.resources
kr6LJba5n.Resources.resources
a7471dd259b381.Resources.resources
429641d30
[NBF]root.Data
429641d31
[NBF]root.Data
429641d310
[NBF]root.Data
429641d311
[NBF]root.Data
429641d312
[NBF]root.Data
429641d32
[NBF]root.Data
429641d33
[NBF]root.Data
429641d34
[NBF]root.Data
429641d35
[NBF]root.Data
429641d36
[NBF]root.Data
429641d37
[NBF]root.Data
429641d38
[NBF]root.Data
429641d39
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙