Malicious
Malicious

7192731baec2a32f438a994c15f8ce8b

Share on LinkedIn
Print
PE Executable
MD5: 7192731baec2a32f438a994c15f8ce8b
Size: 2.09 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
2.09 MB · 2,087,424 B
First seen
2026-07-22 07:31 · 3 months ago
Last seen
2026-07-22 07:31 · 3 months ago
Last analysis
2026-07-23 05:17 · 3 months ago
Hashes
MD5 7192731baec2a32f438a994c15f8ce8b Sha1 9175fbce719442bbd2768a1e67c4fb94a6f3c367 Sha256 b24fefefe8a95d6a765caff9b0ae40ed480dfdbfe2e5a46848b1a9d895ec83e3 Sha384 692befeb6eff36a31d3b3bf0e593c1f8d0fe6029d235a9a20ed26e7e1e50e57e502636c3d569373f6f502ff3c782add6 Sha512 2033f9a945a03bbece3a3114e6104790d2b5900a7fd1cee1d644a04b9d1c72052b23684ac55914086682a190d7783a6b3c9af9928abfa9b49a063d91ca115a39 SSDeep 24576:uf2UxAPqGcv/+Duyx4tVItPAO8I8vo7Ve752lkO8/MshOXzBuqLG2rZkRJxT:u3qPRcvEAGtE1A71cYBM2t TLSH B4A5120C27E85B56EC7D8B3A84345AA493F0BC42A72ADB5E7E4C31ED0E357C0A946753
Detection
PeID
.NET executableMEW 11 SE 1.2Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
2 malicious · 141 files
EXE7192731baec2a32f438a994c15f8ce8b.NET Reflective Loader
Structure
BIN.Net Reflective Loader
EXEGenitalk.klaoxao.tiff [AES Decrypted]
Structure
BINOverlay_ddd3db78.bin
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes
Name Value
Module Name
3Kwkw
Full Name
3Kwkw
EntryPoint
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Scope Name
3Kwkw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3Kwkw
Assembly Version
9.6.29.151
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean 3Kwkw.2jpLcrR::Tt8prkJ()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void 3Kwkw.2jpLcrR::Pix06()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void 3Kwkw.2jpLcrR::6Xqdi0z(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void 3Kwkw.2jpLcrR::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
Module Name
3Kwkw
Full Name
3Kwkw
EntryPoint
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Scope Name
3Kwkw
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3Kwkw
Assembly Version
9.6.29.151
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1031
Main Method
System.Void 3Kwkw.2jpLcrR::bc9CkDs1()
Main IL Instruction Count
37
Main IL 
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean 3Kwkw.2jpLcrR::Tt8prkJ()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0038: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
call System.Void 3Kwkw.2jpLcrR::Pix06()
nop <null>
ldstr requiredResources(1)
ldstr requiredResources(3)
call System.Void 3Kwkw.2jpLcrR::6Xqdi0z(System.String,System.String)
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void 3Kwkw.2jpLcrR::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙