Suspicious
Suspect

6dbc78e7f56e4d05dbf61e3f205b339d

PE Executable
MD5: 6dbc78e7f56e4d05dbf61e3f205b339d
Size: 89.09 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 6dbc78e7f56e4d05dbf61e3f205b339d
Sha1 e255fc4314b98064497406940c36c77755c1627a
Sha256 f0f06d6d0f3bbcafb30dd9fd31bf75974e8f19fbb1f226ecada15720496da9ef
Sha384 109eb24d777bb30bc22914ea1a5c6f04a37fc2904b7efd4b6afa91e01457d14e0a12b35c41c70f518a514179bc5f3d68
Sha512 10fe0204e16c61ab91f6b183de3beb4a5f8d701b62c41d18acd326cf6e21831ed538472ea5137da775b9fa7210238dd9ab0d6aed8f12ad39806a5f832bf4cd2c
SSDeep 1536:7e1Qda8UdmdDUfOWnU18NMS40RJ85h2BCbzaer9baRInopjXXT1y9Wp31+qbR:QQCdmdDUfOWnU18NMS4iJk2gN9baRao5
TLSH 39933A0CB2C59671D0AF9B3545E25720C3B592036643FB4E0DEED1856E833C4AB85ABE
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6dbc78e7f56e4d05dbf61e3f205b339d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
_1ph7suTHxm14t.Properties.Resources.resources
shit.jpg
shit.jpg-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
stees
Full Name
stees
EntryPoint
System.Void sO2::vkuyi4()
Scope Name
stees
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gjiew
Assembly Version
231.543.54.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
714
Main Method
System.Void sO2::vkuyi4()
Main IL Instruction Count
196
Main IL 
nop <null>
ldstr 9X3@
a
ldstr z7At_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.String fVX7G::r_WR()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
stloc.0 <null>
nop <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
dup <null>
brtrue IL_006D: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
call System.Void fVX7G::zj()
nop <null>
ldsfld System.String xDkXGh::h9nY
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0097: ldc.i4.0
call System.Boolean fVX7G::x15()
br IL_0098: stloc.1
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_00A8: ldsfld System.String xDkXGh::jsL
nop <null>
ldc.i4.5 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_010F: nop
nop <null>
call System.Void fVX7G::jef()
nop <null>
ldsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
dup <null>
brtrue IL_00E7: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void sO2::set_beaconService(System.Threading.Thread)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Start()
nop <null>
nop <null>
br IL_0117: ldsfld System.String qW9QhZ::n0
nop <null>
call System.Void fVX7G::vlgBt5()
nop <null>
nop <null>
ldsfld System.String qW9QhZ::n0
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_01D3: ldsfld System.String xDkXGh::gEhuxW
nop <null>
call System.Boolean av::jTE()
pop <null>
ldsfld bvz[] xDkXGh::dp1mh
call System.Byte[] qW9QhZ::vAC(bvz[])
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldstr ,2*Y$+(QeWlh
ldstr yBF6E
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_01B8: ldloc.s V_5
nop <null>
ldloc.s V_4
call System.Boolean qW9QhZ::kF3pWS(System.Byte[])
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse IL_019A: nop
nop <null>
ldstr 2"a 
ldstr soPL4
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
br IL_01B7: nop
nop <null>
ldstr 3P<Z]:$[
ldstr sRz5_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.Void qW9QhZ::el()
nop <null>
nop <null>
nop <null>
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brtrue IL_015B: nop
ldsfld System.String xDkXGh::utfY
ldc.i4.1 <null>
call System.Void wC::uXnW(System.String,System.Boolean)
nop <null>
nop <null>
ldsfld System.String xDkXGh::gEhuxW
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_8
ldloc.s V_8
brfalse IL_01F3: ldsfld System.String xDkXGh::kN
nop <null>
call System.Void g0L::dn()
nop <null>
nop <null>
ldsfld System.String xDkXGh::kN
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_9
ldloc.s V_9
brfalse IL_0213: ldsfld System.String xDkXGh::jsL
nop <null>
call System.Void g0L::eA()
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0234: ldc.i4.0
call System.Threading.Thread sO2::get_beaconService()
ldnull <null>
cgt.un <null>
br IL_0235: stloc.s V_10
ldc.i4.0 <null>
stloc.s V_10
ldloc.s V_10
brfalse IL_026B: ret
nop <null>
ldsfld System.String xDkXGh::dIDaGB
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_11
ldloc.s V_11
brfalse IL_025F: call System.Threading.Thread sO2::get_beaconService()
nop <null>
call System.Boolean zEU51::xz()
pop <null>
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Join()
nop <null>
nop <null>
ret <null>
Module Name
stees
Full Name
stees
EntryPoint
System.Void sO2::vkuyi4()
Scope Name
stees
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gjiew
Assembly Version
231.543.54.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
714
Main Method
System.Void sO2::vkuyi4()
Main IL Instruction Count
196
Main IL 
nop <null>
ldstr 9X3@
a
ldstr z7At_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.String fVX7G::r_WR()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
stloc.0 <null>
nop <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
dup <null>
brtrue IL_006D: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
call System.Void fVX7G::zj()
nop <null>
ldsfld System.String xDkXGh::h9nY
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0097: ldc.i4.0
call System.Boolean fVX7G::x15()
br IL_0098: stloc.1
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_00A8: ldsfld System.String xDkXGh::jsL
nop <null>
ldc.i4.5 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_010F: nop
nop <null>
call System.Void fVX7G::jef()
nop <null>
ldsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
dup <null>
brtrue IL_00E7: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void sO2::set_beaconService(System.Threading.Thread)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Start()
nop <null>
nop <null>
br IL_0117: ldsfld System.String qW9QhZ::n0
nop <null>
call System.Void fVX7G::vlgBt5()
nop <null>
nop <null>
ldsfld System.String qW9QhZ::n0
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_01D3: ldsfld System.String xDkXGh::gEhuxW
nop <null>
call System.Boolean av::jTE()
pop <null>
ldsfld bvz[] xDkXGh::dp1mh
call System.Byte[] qW9QhZ::vAC(bvz[])
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldstr ,2*Y$+(QeWlh
ldstr yBF6E
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_01B8: ldloc.s V_5
nop <null>
ldloc.s V_4
call System.Boolean qW9QhZ::kF3pWS(System.Byte[])
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse IL_019A: nop
nop <null>
ldstr 2"a 
ldstr soPL4
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
br IL_01B7: nop
nop <null>
ldstr 3P<Z]:$[
ldstr sRz5_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.Void qW9QhZ::el()
nop <null>
nop <null>
nop <null>
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brtrue IL_015B: nop
ldsfld System.String xDkXGh::utfY
ldc.i4.1 <null>
call System.Void wC::uXnW(System.String,System.Boolean)
nop <null>
nop <null>
ldsfld System.String xDkXGh::gEhuxW
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_8
ldloc.s V_8
brfalse IL_01F3: ldsfld System.String xDkXGh::kN
nop <null>
call System.Void g0L::dn()
nop <null>
nop <null>
ldsfld System.String xDkXGh::kN
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_9
ldloc.s V_9
brfalse IL_0213: ldsfld System.String xDkXGh::jsL
nop <null>
call System.Void g0L::eA()
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0234: ldc.i4.0
call System.Threading.Thread sO2::get_beaconService()
ldnull <null>
cgt.un <null>
br IL_0235: stloc.s V_10
ldc.i4.0 <null>
stloc.s V_10
ldloc.s V_10
brfalse IL_026B: ret
nop <null>
ldsfld System.String xDkXGh::dIDaGB
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_11
ldloc.s V_11
brfalse IL_025F: call System.Threading.Thread sO2::get_beaconService()
nop <null>
call System.Boolean zEU51::xz()
pop <null>
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Join()
nop <null>
nop <null>
ret <null>
6dbc78e7f56e4d05dbf61e3f205b339d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
_1ph7suTHxm14t.Properties.Resources.resources
shit.jpg
shit.jpg-preview.png
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙