Deep Malware Analysis of 73bcd8d003f905f3ff029d977a97f05e | md5: 73bcd8d003f905f3ff029d977a97f05e | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.91

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	73bcd8d003f905f3ff029d977a97f05e
Sha1	34fbbc58ae2e941806dbbcf8d6c25bd76d1b9368
Sha256	53802a0417b92993ecb62b94c224c1a297b57cdf171dfac69e792aba0c2be4c1
Sha384	4327ff0764d138145ec827af910660a39ad26cd3949c3c9c4edfe2d446d56f75e240023cadebfb537e09527a8e5e786e
Sha512	ec1cbffe67f8b7568af0d73effc145c987fe1ef089ec6b1eb829b295f68174bdc573d6b557e47759cbce171c69fa9833ca7034d0c5ebbc9f0034583715258a75
SSDeep	12288:3iEfIwoUwtfLxNNu6yvs5N1IQeDm5m7zK8Hb9kHdtVwhQ:3HorFNNDy0xmm5G9w7wh
TLSH	5305BF6736524E51C2494B73C19B8A0083A396C6F9E7F30FB28413A55C973FEDA076A7

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Kblhaeavdx.exe
Full Name	Kblhaeavdx.exe
EntryPoint	System.Void Y0d4KNVQLd5nhoZ4pU.H4qCCWYQkWT6KagHr0::dwpH4Uk0L()
Scope Name	Kblhaeavdx.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Kblhaeavdx
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void Y0d4KNVQLd5nhoZ4pU.H4qCCWYQkWT6KagHr0::dwpH4Uk0L()
Main IL Instruction Count	97
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0010: ldloc V_1 br IL_0061: ret ldsfld pZBEhJYSbxrkZeQN3Xf pZBEhJYSbxrkZeQN3Xf::lgIYkCU0YA call System.Void pZBEhJYSbxrkZeQN3Xf::TZoYjrLYyP(pZBEhJYSbxrkZeQN3Xf) ldc.i4 0 ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_0768b16eca8a4812a827e4d41c8c4204 brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061) pop <null> ldc.i4 3 br IL_0014: switch(IL_0062,IL_0038,IL_0061) ret <null> nop <null> ldsfld Jmp9kqYDv1WBBWnsL2G Jmp9kqYDv1WBBWnsL2G::G2CYaMKoH8 call System.Byte[] Jmp9kqYDv1WBBWnsL2G::TZoYjrLYyP(Jmp9kqYDv1WBBWnsL2G) stloc.s V_0 ldc.i4 2 ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_a7a9fb95aa6345eea8c1efb79a971c31 brtrue IL_00A0: switch(IL_00C0,IL_013C) pop <null> ldc.i4 0 br IL_00A0: switch(IL_00C0,IL_013C) br IL_009C: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 989 beq IL_009C: ldloc V_3 br IL_013C: leave IL_0061 ldc.i4 -1576153205 ldc.i4 -1511983490 sub <null> ldc.i4 -1230800839 xor <null> ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_9a018853c93a4367aee25c826f8c2c0c xor <null> ldsfld jWJ64UY3jmXY7CO0Fbk jWJ64UY3jmXY7CO0Fbk::qmeYnRYTUO call System.String jWJ64UY3jmXY7CO0Fbk::TZoYjrLYyP(System.Int32,jWJ64UY3jmXY7CO0Fbk) ldc.i4 1025516628 not <null> ldc.i4 -982919293 xor <null> ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_8f4ca01593884672933b1131be0c9757 xor <null> ldsfld jWJ64UY3jmXY7CO0Fbk jWJ64UY3jmXY7CO0Fbk::qmeYnRYTUO call System.String jWJ64UY3jmXY7CO0Fbk::TZoYjrLYyP(System.Int32,jWJ64UY3jmXY7CO0Fbk) newobj System.Void OGdgGQyvLXN0lyfdw5.p2oJUvqSJYD9KNGnKj::.ctor(System.String,System.String) newobj System.Void edXh7nrF4f3oG4X1VYH.mn62KBrK2lLLScByNsN::.ctor(OGdgGQyvLXN0lyfdw5.p2oJUvqSJYD9KNGnKj) ldloc.s V_0 ldsfld TN6EbaYO8NNmdLIyKZD TN6EbaYO8NNmdLIyKZD::T6fYzHE8RC call System.Void TN6EbaYO8NNmdLIyKZD::TZoYjrLYyP(System.Object,System.Byte[],TN6EbaYO8NNmdLIyKZD) ldc.i4 2 ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_b341ec28da5447c99d5e01f0eb314db1 brtrue IL_00A0: switch(IL_00C0,IL_013C) pop <null> ldc.i4 1 br IL_00A0: switch(IL_00C0,IL_013C) leave IL_0061: ret pop <null> ldc.i4 0 ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_ad96a9f302dd448ba6644095c09758dc brfalse IL_0173: switch(IL_018F) pop <null> ldc.i4 2 br IL_0173: switch(IL_018F) br IL_016F: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_016F: ldloc V_2 br IL_018F: leave IL_0061 leave IL_0061: ret ldc.i4 0 ldsfld <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c} <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_db0a86b46b8047cb9b0f472fbb7c5bba ldfld System.Int32 <Module>{ce3da2ea-dc2d-4723-8223-dc4c49a98a7c}::m_5845aa4087d64638bce0f0b3b55e2596 brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061) pop <null> ldc.i4 2 br IL_0014: switch(IL_0062,IL_0038,IL_0061)