Suspicious
Suspect

7706d59dcf3e7784a0245623043086b8

PE Executable
MD5: 7706d59dcf3e7784a0245623043086b8
Size: 878.59 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 7706d59dcf3e7784a0245623043086b8
Sha1 b043f1153c59a34d734a8e7f6f0dbd4069f49342
Sha256 053d4d811247b09f4d5d86b4de2c480cbcc942ef989b79ee2579a198d743e8e1
Sha384 4c1b8c439ca87baab8476280936d2ba2bfd2227661ccc0f1dbc5beb726ce44142e02458dea79ae0382b1707ee229365a
Sha512 f304ac0f30e165ef5a346a97284d887e97b29357c951d7d61a74e44c572ce0fb8776b940b908b31ae1cfdc213a321f85bd4d6c3a599199e27f6e381e67cadabd
SSDeep 12288:sJJuwcYL2jIh+dyHE9p+cXWfYQM1XZRrNXl9qAjg7OwXyF9kNFZVjo5:0JuwL2MhgqlgQMFpl9xeAm72
TLSH A515DF4113E89A69F8BEAB3CA478152047F1FC56EA35D77E6E4940ED1872F80CA61733
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
7706d59dcf3e7784a0245623043086b8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tafinobix.kbfida.levi
8eyXQ.Resources.resources
b242dffe8140f8.Resources.resources
00c581530
[NBF]root.Data
00c581531
[NBF]root.Data
00c581532
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
8eyXQ
Full Name
8eyXQ
EntryPoint
System.Void 8eyXQ.9MjaQnz8::xs4RX5bxpQ3()
Scope Name
8eyXQ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8eyXQ
Assembly Version
20.18.49.271
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Info
PE Detect: PeReader OK (file layout)
Total Strings
1399
Main Method
System.Void 8eyXQ.9MjaQnz8::xs4RX5bxpQ3()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object 8eyXQ.RenoLedger.Tig3tk2S8Ez/Njx3bB7c9ax.Pcd8n::Kw6kx8Mrin1Y3d(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 8eyXQ.9MjaQnz8::rRc5x8Pz1y(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void 8eyXQ.9MjaQnz8::0WotZpy92Gxi(System.Object[],System.Int32)
nop <null>
ret <null>
Module Name
8eyXQ
Full Name
8eyXQ
EntryPoint
System.Void 8eyXQ.9MjaQnz8::xs4RX5bxpQ3()
Scope Name
8eyXQ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
8eyXQ
Assembly Version
20.18.49.271
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1399
Main Method
System.Void 8eyXQ.9MjaQnz8::xs4RX5bxpQ3()
Main IL Instruction Count
41
Main IL 
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
ldc.r8 25
stloc.1 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldstr kbfida.levi
stloc.3 <null>
ldloc.3 <null>
call System.Object 8eyXQ.RenoLedger.Tig3tk2S8Ez/Njx3bB7c9ax.Pcd8n::Kw6kx8Mrin1Y3d(System.String)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldloc.s V_4
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 8eyXQ.9MjaQnz8::rRc5x8Pz1y(System.Object)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_5
ldloc.2 <null>
ldloc.1 <null>
ldc.r8 1
sub <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.2 <null>
ldloc.1 <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Void 8eyXQ.9MjaQnz8::0WotZpy92Gxi(System.Object[],System.Int32)
nop <null>
ret <null>
7706d59dcf3e7784a0245623043086b8
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tafinobix.kbfida.levi
8eyXQ.Resources.resources
b242dffe8140f8.Resources.resources
00c581530
[NBF]root.Data
00c581531
[NBF]root.Data
00c581532
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙