Malicious
Malicious

734f2038edc0fb655e13004199f9e7da

PE Executable
MD5: 734f2038edc0fb655e13004199f9e7da
Size: 3.66 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 734f2038edc0fb655e13004199f9e7da
Sha1 ebdf31eea680b4e3db0265e1bc9d99e1236674e8
Sha256 d5aea22bf23f26d0c83d5d96f46f16a4207b69a37956ce975c1b7b2351fcc5cf
Sha384 6bc1abeb3831a0a20335520d3bd07c5605d2cf70b63f3d960f06d9180c1bd41d1b66a9e7f94387acfddb01f019b95545
Sha512 504f768927f8f7e5cb6738aa46cc2fc7d9b54a26960c78da41237fcf6868d68567490c3b1c2d03369110155e8cb46a14b7027f232e501a079e249bd66a4b7436
SSDeep 49152:WLZoXeXCFaONlGzCdGTGAXD2vO6cOJyLuAcLKzAa9oU7Tc4:WGuXAlGGdGTGAXD2vbXaN5
TLSH 9E06F10A95924F3BC26097358497443E53A4C7767962FB0B3A1F11D26C037B9DFB22AB
PeID
HQR data fileMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
734f2038edc0fb655e13004199f9e7da
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
JZdGPOJFXyRyGvkSXg.FgcAj3i5UGdHrDMhjH
VVPEM3Si2oWtammMq3.oTaBNCosIslfm3uQPP
HslAmZuJNYuSPWC9MT.OtuhOF2e3FtUHKaF8M
1isS63KQToqHw5pNyJ.2SlHcdUaw3r4JlUZJ6
b30siKDSB5p4uqhmtN.73S9OtqOnyLtC2edPK
019n5awL9q9MuQOGNM.3NSrf0cINCWHwrFyC3
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void aoAihXeUFQp64oiIw84.IjlI02eKG99sW9mHLVJ::pyQeS5bPNn()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void aoAihXeUFQp64oiIw84.IjlI02eKG99sW9mHLVJ::pyQeS5bPNn()
Main IL Instruction Count
46
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00BD: ldnull
call System.Void VUF4bUlCB4I9p8UmgCq.mqFaeclfvRK6BSGy10S::xYhcu1K3cBq()
ldc.i4 0
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_17d40ac5f3e74995a6102bbca8059dbd
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ldc.i4 769137693
ldc.i4 1622700540
xor <null>
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_6320b04730f24d008f66fae709944ce2
xor <null>
call System.String iOeKWCafOvNpwwBcMZw.tGp1xwaVs2rU6BEf5Ny::IOVaXDX0dn(System.Int32)
newobj System.Void IKXRje2D8pS6hNBnVNh.sKWBpL2iMar8TjWamkE::.ctor(System.String)
call System.Void IKXRje2D8pS6hNBnVNh.sKWBpL2iMar8TjWamkE::xIl2qpMhbV()
ldc.i4 4
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_8585994631be44719c21299494bb5e50
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
newobj System.Void VGBZPCuiIesfPuqZMDS.qyQsoUuJpnsQW5EbKVT::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_f8e50280c5cf4399b3e1e281f4cc9181
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ldnull <null>
ldnull <null>
newobj System.Void GHfWYaUYZ7LbgYMxJRm.Thwav4U4VyJTCMkZR79::.ctor(System.String,System.String)
call System.Void SULlu5c6aiaxZod2OAu.t7iEMxceiFL2bWfyWBb::jLXcrG5kTs(GHfWYaUYZ7LbgYMxJRm.Thwav4U4VyJTCMkZR79)
ldc.i4 3
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ret <null>
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void aoAihXeUFQp64oiIw84.IjlI02eKG99sW9mHLVJ::pyQeS5bPNn()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void aoAihXeUFQp64oiIw84.IjlI02eKG99sW9mHLVJ::pyQeS5bPNn()
Main IL Instruction Count
46
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00BD: ldnull
call System.Void VUF4bUlCB4I9p8UmgCq.mqFaeclfvRK6BSGy10S::xYhcu1K3cBq()
ldc.i4 0
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_17d40ac5f3e74995a6102bbca8059dbd
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ldc.i4 769137693
ldc.i4 1622700540
xor <null>
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_6320b04730f24d008f66fae709944ce2
xor <null>
call System.String iOeKWCafOvNpwwBcMZw.tGp1xwaVs2rU6BEf5Ny::IOVaXDX0dn(System.Int32)
newobj System.Void IKXRje2D8pS6hNBnVNh.sKWBpL2iMar8TjWamkE::.ctor(System.String)
call System.Void IKXRje2D8pS6hNBnVNh.sKWBpL2iMar8TjWamkE::xIl2qpMhbV()
ldc.i4 4
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_8585994631be44719c21299494bb5e50
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
newobj System.Void VGBZPCuiIesfPuqZMDS.qyQsoUuJpnsQW5EbKVT::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93} <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_11d5c990a36049fd95173867f9593e47
ldfld System.Int32 <Module>{81cc1dd4-1ff6-4407-b63e-873100539c93}::m_f8e50280c5cf4399b3e1e281f4cc9181
brfalse IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ldnull <null>
ldnull <null>
newobj System.Void GHfWYaUYZ7LbgYMxJRm.Thwav4U4VyJTCMkZR79::.ctor(System.String,System.String)
call System.Void SULlu5c6aiaxZod2OAu.t7iEMxceiFL2bWfyWBb::jLXcrG5kTs(GHfWYaUYZ7LbgYMxJRm.Thwav4U4VyJTCMkZR79)
ldc.i4 3
br IL_0012: switch(IL_00BD,IL_0098,IL_0030,IL_0054,IL_00D3)
ret <null>
734f2038edc0fb655e13004199f9e7da
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
JZdGPOJFXyRyGvkSXg.FgcAj3i5UGdHrDMhjH
VVPEM3Si2oWtammMq3.oTaBNCosIslfm3uQPP
HslAmZuJNYuSPWC9MT.OtuhOF2e3FtUHKaF8M
1isS63KQToqHw5pNyJ.2SlHcdUaw3r4JlUZJ6
b30siKDSB5p4uqhmtN.73S9OtqOnyLtC2edPK
019n5awL9q9MuQOGNM.3NSrf0cINCWHwrFyC3
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙