Malicious
Malicious

6744f30661222d36f40dc99e3d1f2777

Share on LinkedIn
Print
PE Executable
MD5: 6744f30661222d36f40dc99e3d1f2777
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 6744f30661222d36f40dc99e3d1f2777
Sha1 759fb1503989f856cdd91594828dc2b2834b49f5
Sha256 fce095e4833357bbebd160357a28826a360dbcdf4c5eee2a47503e63549dc2af
Sha384 2114ddf2a7e8e0f007e3d0c2c295f44d52205e563be51b7e749797a8882898a7f7fb01c86738737047090f1d52d6e983
Sha512 d5afa79ed8b512acf0f45af2d3b4d8949d8c3a1b022a29b4981760b25494715665b8a961108757319662dde9a166642ba672a9ee2b7e2de33f2744028eb9e317
SSDeep 12288:k/vEx2shyoRFoQE5Ob7faF1pUg0E7KijGdxo6Jq4WaYnE:th5FGOb7f87Ug0EuiKg6JF
TLSH B005AE2A76D68F32C24A4373C2C7490097AA9947B6A7FB0B318513D61D433FEDA06797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6744f30661222d36f40dc99e3d1f2777
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ru5mAnbfcH2HfUe74j.iq2N7trHdDj7cbCXIM
CXXBvoTo6y2tCa6IoP.HAXOL5hYsxnxGKeXPH
QBORpp07lHih4WtjiL.xPguhq5jef7HHP99Ux
hjeDrstGWYGXkfJVh6.A42NRKJUJMOUwd7ZhO
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Harkqu.exe
Full Name
Harkqu.exe
EntryPoint
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Scope Name
Harkqu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Harkqu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
nop <null>
ldsfld M5quTdNb7RqnDCiUBkP M5quTdNb7RqnDCiUBkP::MrPNrOpwy9
call System.Byte[] M5quTdNb7RqnDCiUBkP::tsDNoeMlUg(M5quTdNb7RqnDCiUBkP)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_b6f93b86a8004e1db74d5637775ae28d
brfalse IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0121)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0121: leave IL_0038
ldc.i4 1841001556
ldc.i4 4
shl <null>
ldc.i4 -932564629
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_f991429306684f1fb324b4ecc6359964
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
ldc.i4 -938130001
ldc.i4 -324386128
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_1c4bbc512f9949dd9103754bafda895b
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
newobj System.Void i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld n4binBNB0wxQ8crINjc n4binBNB0wxQ8crINjc::NRWNpBIR9V
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 n4binBNB0wxQ8crINjc::tsDNoeMlUg(System.Object,System.Byte[],n4binBNB0wxQ8crINjc)
ldsfld K7PHXbNWO2xsLJo1pPY K7PHXbNWO2xsLJo1pPY::KtUNxlNKSG
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 K7PHXbNWO2xsLJo1pPY::tsDNoeMlUg(System.Object,K7PHXbNWO2xsLJo1pPY)
ldsfld Pkj5ykNafEhSGYpy5ar Pkj5ykNafEhSGYpy5ar::PXANs3bj6c
call System.Void Pkj5ykNafEhSGYpy5ar::tsDNoeMlUg(System.Object,Pkj5ykNafEhSGYpy5ar)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_cbe2a6068e654830a55ad12734544f55
brtrue IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_0097,IL_0121)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_aaa83b334a944dda81e69667f794ab8a
brtrue IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0154: ldloc V_0
br IL_0174: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_7e16e3f2bc804dc9ae6ccac522a75ef5
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
ldsfld RcYfbuNT5SpWBm0YJtN RcYfbuNT5SpWBm0YJtN::FTJNhLjjhg
call System.Void RcYfbuNT5SpWBm0YJtN::tsDNoeMlUg(RcYfbuNT5SpWBm0YJtN)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_5c81e8c8adb04faab50085cab66bcc40
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
Module Name
Harkqu.exe
Full Name
Harkqu.exe
EntryPoint
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Scope Name
Harkqu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Harkqu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NoMu9U7Z1ngrPpEdbB.FGh3aLNuQK2uD0WDSH::g8EBtfFDI()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
nop <null>
ldsfld M5quTdNb7RqnDCiUBkP M5quTdNb7RqnDCiUBkP::MrPNrOpwy9
call System.Byte[] M5quTdNb7RqnDCiUBkP::tsDNoeMlUg(M5quTdNb7RqnDCiUBkP)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_b6f93b86a8004e1db74d5637775ae28d
brfalse IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0121)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0121: leave IL_0038
ldc.i4 1841001556
ldc.i4 4
shl <null>
ldc.i4 -932564629
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_f991429306684f1fb324b4ecc6359964
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
ldc.i4 -938130001
ldc.i4 -324386128
xor <null>
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_1c4bbc512f9949dd9103754bafda895b
xor <null>
ldsfld ximGAZNNjli55chZwQd ximGAZNNjli55chZwQd::sTyN7kx7Xw
call System.String ximGAZNNjli55chZwQd::tsDNoeMlUg(System.Int32,ximGAZNNjli55chZwQd)
newobj System.Void i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld n4binBNB0wxQ8crINjc n4binBNB0wxQ8crINjc::NRWNpBIR9V
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 n4binBNB0wxQ8crINjc::tsDNoeMlUg(System.Object,System.Byte[],n4binBNB0wxQ8crINjc)
ldsfld K7PHXbNWO2xsLJo1pPY K7PHXbNWO2xsLJo1pPY::KtUNxlNKSG
call i9uEv0tMojTKwvgsvqj.TXBwmato3MZyRCS0uc8 K7PHXbNWO2xsLJo1pPY::tsDNoeMlUg(System.Object,K7PHXbNWO2xsLJo1pPY)
ldsfld Pkj5ykNafEhSGYpy5ar Pkj5ykNafEhSGYpy5ar::PXANs3bj6c
call System.Void Pkj5ykNafEhSGYpy5ar::tsDNoeMlUg(System.Object,Pkj5ykNafEhSGYpy5ar)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_cbe2a6068e654830a55ad12734544f55
brtrue IL_0077: switch(IL_0097,IL_0121)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_0097,IL_0121)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_aaa83b334a944dda81e69667f794ab8a
brtrue IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0154: ldloc V_0
br IL_0174: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_7e16e3f2bc804dc9ae6ccac522a75ef5
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
ldsfld RcYfbuNT5SpWBm0YJtN RcYfbuNT5SpWBm0YJtN::FTJNhLjjhg
call System.Void RcYfbuNT5SpWBm0YJtN::tsDNoeMlUg(RcYfbuNT5SpWBm0YJtN)
ldc.i4 1
ldsfld <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b} <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_3d39de4b2d6148d29eee5def6452d4c3
ldfld System.Int32 <Module>{c17f0012-7d4b-407f-b26f-db4173aa591b}::m_5c81e8c8adb04faab50085cab66bcc40
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0198)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙