Malicious
Malicious

6744f30661222d36f40dc99e3d1f2777

PE Executable
MD5: 6744f30661222d36f40dc99e3d1f2777
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 6744f30661222d36f40dc99e3d1f2777
Sha1 759fb1503989f856cdd91594828dc2b2834b49f5
Sha256 fce095e4833357bbebd160357a28826a360dbcdf4c5eee2a47503e63549dc2af
Sha384 2114ddf2a7e8e0f007e3d0c2c295f44d52205e563be51b7e749797a8882898a7f7fb01c86738737047090f1d52d6e983
Sha512 d5afa79ed8b512acf0f45af2d3b4d8949d8c3a1b022a29b4981760b25494715665b8a961108757319662dde9a166642ba672a9ee2b7e2de33f2744028eb9e317
SSDeep 12288:k/vEx2shyoRFoQE5Ob7faF1pUg0E7KijGdxo6Jq4WaYnE:th5FGOb7f87Ug0EuiKg6JF
TLSH B005AE2A76D68F32C24A4373C2C7490097AA9947B6A7FB0B318513D61D433FEDA06797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6744f30661222d36f40dc99e3d1f2777
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ru5mAnbfcH2HfUe74j.iq2N7trHdDj7cbCXIM
CXXBvoTo6y2tCa6IoP.HAXOL5hYsxnxGKeXPH
QBORpp07lHih4WtjiL.xPguhq5jef7HHP99Ux
hjeDrstGWYGXkfJVh6.A42NRKJUJMOUwd7ZhO
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Harkqu.exe
Full Name
Harkqu.exe
EntryPoint
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Scope Name
Harkqu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Harkqu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
nop <null>
ldsfld M5quTdNb7RqnDCiUBkP M5quTdNb7RqnDCiUBkP::MrPNrOpwy9
call System.Byte[] M5quTdNb7RqnDCiUBkP::tsDNoeMlUg(M5quTdNb7RqnDCiUBkP)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_b6f93b86a8004e1db74d5637775ae28d
brfalse IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0121)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0121: leave IL_0038
ldc.i4 1841001556
ldc.i4 4
shl <null>
ldc.i4 -932564629
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_f991429306684f1fb324b4ecc6359964
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
ldc.i4 -938130001
ldc.i4 -324386128
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_1c4bbc512f9949dd9103754bafda895b
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
newobj System.Void i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld n4binBNB0wxQ8crINjc n4binBNB0wxQ8crINjc::NRWNpBIR9V
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 n4binBNB0wxQ8crINjc::tsDNoeMlUg(System.Object,System.Byte[],n4binBNB0wxQ8crINjc)
ldsfld K7PHXbNWO2xsLJo1pPY K7PHXbNWO2xsLJo1pPY::KtUNxlNKSG
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 K7PHXbNWO2xsLJo1pPY::tsDNoeMlUg(System.Object,K7PHXbNWO2xsLJo1pPY)
ldsfld Pkj5ykNafEhSGYpy5ar Pkj5ykNafEhSGYpy5ar::PXANs3bj6c
call System.Void Pkj5ykNafEhSGYpy5ar::tsDNoeMlUg(System.Object,Pkj5ykNafEhSGYpy5ar)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_cbe2a6068e654830a55ad12734544f55
brtrue IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_0097,IL_0121)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_aaa83b334a944dda81e69667f794ab8a
brtrue IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0154: ldloc V_0
br IL_0174: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_7e16e3f2bc804dc9ae6ccac522a75ef5
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
ldsfld RcYfbuNT5SpWBm0YJtN RcYfbuNT5SpWBm0YJtN::FTJNhLjjhg
call System.Void RcYfbuNT5SpWBm0YJtN::tsDNoeMlUg(RcYfbuNT5SpWBm0YJtN)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_5c81e8c8adb04faab50085cab66bcc40
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
Module Name
Harkqu.exe
Full Name
Harkqu.exe
EntryPoint
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Scope Name
Harkqu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Harkqu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
nop <null>
ldsfld M5quTdNb7RqnDCiUBkP M5quTdNb7RqnDCiUBkP::MrPNrOpwy9
call System.Byte[] M5quTdNb7RqnDCiUBkP::tsDNoeMlUg(M5quTdNb7RqnDCiUBkP)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_b6f93b86a8004e1db74d5637775ae28d
brfalse IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0121)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0121: leave IL_0038
ldc.i4 1841001556
ldc.i4 4
shl <null>
ldc.i4 -932564629
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_f991429306684f1fb324b4ecc6359964
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
ldc.i4 -938130001
ldc.i4 -324386128
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_1c4bbc512f9949dd9103754bafda895b
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
newobj System.Void i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld n4binBNB0wxQ8crINjc n4binBNB0wxQ8crINjc::NRWNpBIR9V
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 n4binBNB0wxQ8crINjc::tsDNoeMlUg(System.Object,System.Byte[],n4binBNB0wxQ8crINjc)
ldsfld K7PHXbNWO2xsLJo1pPY K7PHXbNWO2xsLJo1pPY::KtUNxlNKSG
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 K7PHXbNWO2xsLJo1pPY::tsDNoeMlUg(System.Object,K7PHXbNWO2xsLJo1pPY)
ldsfld Pkj5ykNafEhSGYpy5ar Pkj5ykNafEhSGYpy5ar::PXANs3bj6c
call System.Void Pkj5ykNafEhSGYpy5ar::tsDNoeMlUg(System.Object,Pkj5ykNafEhSGYpy5ar)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_cbe2a6068e654830a55ad12734544f55
brtrue IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_0097,IL_0121)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_aaa83b334a944dda81e69667f794ab8a
brtrue IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0154: ldloc V_0
br IL_0174: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_7e16e3f2bc804dc9ae6ccac522a75ef5
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
ldsfld RcYfbuNT5SpWBm0YJtN RcYfbuNT5SpWBm0YJtN::FTJNhLjjhg
call System.Void RcYfbuNT5SpWBm0YJtN::tsDNoeMlUg(RcYfbuNT5SpWBm0YJtN)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_5c81e8c8adb04faab50085cab66bcc40
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
6744f30661222d36f40dc99e3d1f2777
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ru5mAnbfcH2HfUe74j.iq2N7trHdDj7cbCXIM
CXXBvoTo6y2tCa6IoP.HAXOL5hYsxnxGKeXPH
QBORpp07lHih4WtjiL.xPguhq5jef7HHP99Ux
hjeDrstGWYGXkfJVh6.A42NRKJUJMOUwd7ZhO
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙