Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.09 MB · 2,087,424 B
First seen
2026-07-22 07:31 · 3 months ago
Last seen
2026-07-22 07:31 · 3 months ago
Last analysis
2026-07-23 05:17 · 3 months ago
Hashes
MD5 7192731baec2a32f438a994c15f8ce8b Sha1 9175fbce719442bbd2768a1e67c4fb94a6f3c367 Sha256 b24fefefe8a95d6a765caff9b0ae40ed480dfdbfe2e5a46848b1a9d895ec83e3 Sha384 692befeb6eff36a31d3b3bf0e593c1f8d0fe6029d235a9a20ed26e7e1e50e57e502636c3d569373f6f502ff3c782add6 Sha512 2033f9a945a03bbece3a3114e6104790d2b5900a7fd1cee1d644a04b9d1c72052b23684ac55914086682a190d7783a6b3c9af9928abfa9b49a063d91ca115a39 SSDeep 24576:uf2UxAPqGcv/+Duyx4tVItPAO8I8vo7Ve752lkO8/MshOXzBuqLG2rZkRJxT:u3qPRcvEAGtE1A71cYBM2t TLSH B4A5120C27E85B56EC7D8B3A84345AA493F0BC42A72ADB5E7E4C31ED0E357C0A946753
Detection
PeID
.NET executableMEW 11 SE 1.2Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
2 malicious · 141 files
EXE7192731baec2a32f438a994c15f8ce8b.NET Reflective Loader
Structure
BINResources
BINRT_ICON
BINID:0032
IMGID:0
IMGID:0-preview.png
BINID:0033
BINID:0
BINID:0034
BINID:0
BINID:0035
BINID:0
BINID:0036
BINID:0
BINID:0037
BINID:0
BINID:0038
BINID:0
BINID:0039
BINID:0
BINID:003A
BINID:0
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
TIFFGenitalk.klaoxao.tiff
BIN3Kwkw.Resources.resources
BIN31da911b7fd69a.Resources.resources
BIN606b6d1b0
DATA[NBF]root.Data
BIN606b6d1b1
DATA[NBF]root.Data
BIN606b6d1b10
DATA[NBF]root.Data
BIN606b6d1b11
DATA[NBF]root.Data
BIN606b6d1b12
DATA[NBF]root.Data
BIN606b6d1b13
DATA[NBF]root.Data
BIN606b6d1b14
DATA[NBF]root.Data
BIN606b6d1b15
DATA[NBF]root.Data
BIN606b6d1b16
DATA[NBF]root.Data
BIN606b6d1b17
DATA[NBF]root.Data
BIN606b6d1b18
DATA[NBF]root.Data
BIN606b6d1b19
DATA[NBF]root.Data
BIN606b6d1b2
DATA[NBF]root.Data
BIN606b6d1b20
DATA[NBF]root.Data
BIN606b6d1b21
DATA[NBF]root.Data
BIN606b6d1b22
DATA[NBF]root.Data
BIN606b6d1b23
DATA[NBF]root.Data
BIN606b6d1b24
DATA[NBF]root.Data
BIN606b6d1b25
DATA[NBF]root.Data
BIN606b6d1b26
DATA[NBF]root.Data
BIN606b6d1b27
DATA[NBF]root.Data
BIN606b6d1b28
DATA[NBF]root.Data
BIN606b6d1b29
DATA[NBF]root.Data
BIN606b6d1b3
DATA[NBF]root.Data
BIN606b6d1b30
DATA[NBF]root.Data
BIN606b6d1b31
DATA[NBF]root.Data
BIN606b6d1b32
DATA[NBF]root.Data
BIN606b6d1b33
DATA[NBF]root.Data
BIN606b6d1b34
DATA[NBF]root.Data
BIN606b6d1b35
DATA[NBF]root.Data
BIN606b6d1b36
DATA[NBF]root.Data
BIN606b6d1b37
DATA[NBF]root.Data
BIN606b6d1b38
DATA[NBF]root.Data
BIN606b6d1b39
DATA[NBF]root.Data
BIN606b6d1b4
DATA[NBF]root.Data
BIN606b6d1b40
DATA[NBF]root.Data
BIN606b6d1b41
DATA[NBF]root.Data
BIN606b6d1b42
DATA[NBF]root.Data
BIN606b6d1b43
DATA[NBF]root.Data
BIN606b6d1b44
DATA[NBF]root.Data
BIN606b6d1b45
DATA[NBF]root.Data
BIN606b6d1b46
DATA[NBF]root.Data
BIN606b6d1b47
DATA[NBF]root.Data
BIN606b6d1b48
DATA[NBF]root.Data
BIN606b6d1b49
DATA[NBF]root.Data
BIN606b6d1b5
DATA[NBF]root.Data
BIN606b6d1b50
DATA[NBF]root.Data
BIN606b6d1b51
DATA[NBF]root.Data
BIN606b6d1b52
DATA[NBF]root.Data
BIN606b6d1b53
DATA[NBF]root.Data
BIN606b6d1b54
DATA[NBF]root.Data
BIN606b6d1b55
DATA[NBF]root.Data
BIN606b6d1b56
DATA[NBF]root.Data
BIN606b6d1b57
DATA[NBF]root.Data
BIN606b6d1b58
DATA[NBF]root.Data
BIN606b6d1b6
DATA[NBF]root.Data
BIN606b6d1b7
DATA[NBF]root.Data
BIN606b6d1b8
DATA[NBF]root.Data
BIN606b6d1b9
DATA[NBF]root.Data
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINObjectRequester.ScopeObject
BINScheduledObject.ObjectParser
BINDecryptorCompressor.ControllableObject
BINAuditorMap.LocalObject
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
3Kwkw
Full Name
3Kwkw
EntryPoint
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Scope Name
3Kwkw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3Kwkw
Assembly Version
9.6.29.151
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean 3Kwkw.2jpLcrR::Tt8prkJ()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void 3Kwkw.2jpLcrR::Pix06()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void 3Kwkw.2jpLcrR::6Xqdi0z(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void 3Kwkw.2jpLcrR::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
3Kwkw
Full Name
3Kwkw
EntryPoint
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Scope Name
3Kwkw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3Kwkw
Assembly Version
9.6.29.151
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean 3Kwkw.2jpLcrR::Tt8prkJ()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void 3Kwkw.2jpLcrR::Pix06()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void 3Kwkw.2jpLcrR::6Xqdi0z(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void 3Kwkw.2jpLcrR::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
2 malicious · 141 files
EXE7192731baec2a32f438a994c15f8ce8b.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙