Deep Malware Analysis of 685edde8c9d6c620f95103765f684f1e | md5: 685edde8c9d6c620f95103765f684f1e | .Net Obfuscator | .Net Reactor | Executable | PE (Portable Executable) | .Net | Managed .NET | PE File Layout | SOS: 0.68 | Win 32 Exe | x86

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score High

MD5	685edde8c9d6c620f95103765f684f1e
Sha1	af87a5209eb1b41026a5d3b417d004b99cf374bb
Sha256	40ef805fbbf333e9a2c47bf8ca3832dd854829da0a31469ec5fd271348b6fab4
Sha384	fb60ed387e8f26119fa0753282a3693d2d7300c5b543b55568f18cb68bd98ba42f325770b93693708d8220724b1acaab
Sha512	21f2b7f3f46ce5ecd154909f2d855ccad0db9321ce072475c28f983330a06d49b68eb78c37d322218b6d813e985bb9c3f634907f5bd8e2903e4e3c0f51d4e60c
SSDeep	24576:vspnmOsm72cKxrIBcDyhtsALtku+kTsew0hqf:en3Ki0yhtrtkuVTO0o
TLSH	2515D0082257CB62DD5437B3CAA2DAF026735D96D593C3EB46F87DA73A31B740498283

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	peeu.exe
Full Name	peeu.exe
EntryPoint	System.Void WN.xx::oy()
Scope Name	peeu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	peeu
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	378
Main Method	System.Void WN.xx::oy()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0021: call System.Void P2p.w2n::ot0() nop <null> newobj System.Void cF.YB::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop call System.Void P2p.w2n::ot0() br IL_0011: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0005: nop`
Module Name	peeu.exe
Full Name	peeu.exe
EntryPoint	System.Void WN.xx::oy()
Scope Name	peeu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	peeu
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	378
Main Method	System.Void WN.xx::oy()
Main IL Instruction Count	16
Main IL	`br IL_002D: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0021: call System.Void P2p.w2n::ot0() nop <null> newobj System.Void cF.YB::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_002B: nop call System.Void P2p.w2n::ot0() br IL_0011: nop nop <null> ret <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_0005: nop`