Deep Malware Analysis of 71586990ee0d60f26317d8e205319fbe | md5: 71586990ee0d60f26317d8e205319fbe | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.92

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	71586990ee0d60f26317d8e205319fbe
Sha1	2993679d0cfe48d95f7393c4dfbb8f31dcd22a78
Sha256	b51bc344759f9b9db3321ab0c07dc807b63bcc8d9ec028443e95eca5292ff5d0
Sha384	4106b978fed5e435b421a898e70b5ba7d4a512689bed2ad28f6a2d70502208725fc1a92ee3fe7f96e10624787d1fb975
Sha512	2e6b857ad26e5ab486d76ac2a259422908c40f2fcaf2e8335451bf7680a87de7602ba5f968bdefa05abe9080f5765698000ba80d08b7f771439988130b926729
SSDeep	12288:zfBxITDPNyLLvigCCz3Eb57b1f5STZVCA8KC1wnYLT6tnfhQZxw:zEDNAOgCCzUbrfxIi0pexw
TLSH	A405BF1736964E61C2850B77D1DB940493B6A986B9E3F30FB28403A51D073FEEE4B693

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Jjtfmecoztx.exe
Full Name	Jjtfmecoztx.exe
EntryPoint	System.Void rroalJ5Sfa4ZjAGJA0.LFyHZ0fX2s13kowSct::FhYJuuWUj()
Scope Name	Jjtfmecoztx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Jjtfmecoztx
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void rroalJ5Sfa4ZjAGJA0.LFyHZ0fX2s13kowSct::FhYJuuWUj()
Main IL Instruction Count	96
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0010: ldloc V_1 br IL_0039: ldsfld b4IZbefxW20eIDkpKMx b4IZbefxW20eIDkpKMx::xnif2Pp8jw ret <null> ldsfld b4IZbefxW20eIDkpKMx b4IZbefxW20eIDkpKMx::xnif2Pp8jw call System.Void b4IZbefxW20eIDkpKMx::Tf5f8unVNq(b4IZbefxW20eIDkpKMx) ldc.i4 0 ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_70f408c1796d41db8c3af4d724349bc0 brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038) pop <null> ldc.i4 7 br IL_0014: switch(IL_0062,IL_0039,IL_0038) nop <null> ldsfld MyuanrfGwUlM2VPRehf MyuanrfGwUlM2VPRehf::jsVf6ZyglP call System.Byte[] MyuanrfGwUlM2VPRehf::Tf5f8unVNq(MyuanrfGwUlM2VPRehf) stloc.s V_2 ldc.i4 7 ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_b9af1ac15c894fe996eed973a742e80f brfalse IL_00A0: switch(IL_00C0,IL_013B) pop <null> ldc.i4 0 br IL_00A0: switch(IL_00C0,IL_013B) br IL_009C: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_009C: ldloc V_0 br IL_00C0: ldc.i4 865480395 ldc.i4 865480395 ldc.i4 177365447 xor <null> ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5c12dace138c41bbbc6abe2af12f4f0f xor <null> ldsfld Qab2CLfACoeJLUj8Ogf Qab2CLfACoeJLUj8Ogf::qAqfiwZkEY call System.String Qab2CLfACoeJLUj8Ogf::Tf5f8unVNq(System.Int32,Qab2CLfACoeJLUj8Ogf) ldc.i4 -2030557552 ldc.i4 1649279389 xor <null> ldc.i4 -1847380566 xor <null> ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_c82712344ef14480a9a5f726ee707231 xor <null> ldsfld Qab2CLfACoeJLUj8Ogf Qab2CLfACoeJLUj8Ogf::qAqfiwZkEY call System.String Qab2CLfACoeJLUj8Ogf::Tf5f8unVNq(System.Int32,Qab2CLfACoeJLUj8Ogf) newobj System.Void j4FJjCaOwAEDySOPX7.TvwPI09wlLiJfTIHsi::.ctor(System.String,System.String) newobj System.Void QMsQxdMLW9Os5wdq2xn.GYoO83MZpuB1aq2h7tU::.ctor(j4FJjCaOwAEDySOPX7.TvwPI09wlLiJfTIHsi) ldloc.s V_2 ldsfld iUcvPyfhHyMsWBkO9r1 iUcvPyfhHyMsWBkO9r1::FMQfzJU646 call System.Void iUcvPyfhHyMsWBkO9r1::Tf5f8unVNq(System.Object,System.Byte[],iUcvPyfhHyMsWBkO9r1) ldc.i4 3 ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_0bc40a96e3bc4f13a428bb523f99b312 brfalse IL_00A0: switch(IL_00C0,IL_013B) pop <null> ldc.i4 1 br IL_00A0: switch(IL_00C0,IL_013B) leave IL_0038: ret pop <null> ldc.i4 0 ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_15d6068bfa984e72956f40dfe53bcfd5 brtrue IL_0172: switch(IL_018E) pop <null> ldc.i4 1 br IL_0172: switch(IL_018E) br IL_016E: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 988 beq IL_016E: ldloc V_3 br IL_018E: leave IL_0038 leave IL_0038: ret ldc.i4 2 ldsfld <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386} <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_5d6df0b4e63444ba8184e1f4298ef8dd ldfld System.Int32 <Module>{7221e6d2-1644-42f4-9858-895a3c8cc386}::m_fc0cecfcbabf4c84bf275610a783714b brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038) pop <null> ldc.i4 5 br IL_0014: switch(IL_0062,IL_0039,IL_0038)