Malicious
Malicious

773dda7eb9d848d9a3491ec2b61a9f0d

PE Executable
MD5: 773dda7eb9d848d9a3491ec2b61a9f0d
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 773dda7eb9d848d9a3491ec2b61a9f0d
Sha1 b6b659b8e152bb1f8d9fc954b68b4542fe256530
Sha256 b366811f3f74717395eddf884e59b329cf192d2a310cf47deadbf4102ef71e67
Sha384 5bc5a23d485e63690af71ad8326f46ab3b26118f94fe67f4f0613fd4b7b88c8ad8cdce0af0b3c895207ddcf60f61a175
Sha512 e723096e8709c6adcd27f02108fb88415f2e45438ce689a865606a317f36174de52bf7c6dfd6a126f9e9a5c740d4ac411bf9e74eb7bd8dfb0d118f87c5d346fe
SSDeep 12288:AdbczmATrCby9KwYzPo9SgCEix/QAh3TgN+18ehFlP9HR2IVY5xd:Us+by9VYoRCEi9ddTgcKedP91yZ
TLSH AD05BE3B32A18F25C1864373C1C3590197AA8A4B36EBEB0B35C513D619467FEDE4A397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
773dda7eb9d848d9a3491ec2b61a9f0d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yAc9yLQmyMnG4Z5bJf.9sjNqE31WDD0ggrEse
xlYSrH6kF2jWByLEwU.SWZXAf7DZ67i8ciBuN
RPwt8w5dvvHoogpA77.I5lhOGZgG0W2dESOOG
qv4wWR2wFgQZwpj7rl.fNJwWx0LU3PnKhufxw
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qryii.exe
Full Name
Qryii.exe
EntryPoint
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Scope Name
Qryii.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qryii
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld Wus2Nbf6a8alMr0yrrk Wus2Nbf6a8alMr0yrrk::uYhf7lcVf5
call System.Byte[] Wus2Nbf6a8alMr0yrrk::RepfdeCSHJ(Wus2Nbf6a8alMr0yrrk)
stloc.s V_3
ldc.i4 6
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_f550602b1b8f48ad9c7aef104f249e30
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_011C: leave IL_0038
ldc.i4 -706789139
ldc.i4 -923518185
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_59fba2c14a5a43ddb78b95ce91a3583b
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
ldc.i4 -24527197
not <null>
ldc.i4 626417631
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_d09e13aa57df409a9bcae1a77764c9a3
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
newobj System.Void NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld iKk2akfjBE73xkeWwkJ iKk2akfjBE73xkeWwkJ::Wcuf4lLrvc
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy iKk2akfjBE73xkeWwkJ::RepfdeCSHJ(System.Object,System.Byte[],iKk2akfjBE73xkeWwkJ)
ldsfld KWS38IfbmbLPLZHhDiN KWS38IfbmbLPLZHhDiN::M0VfkOaCfj
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy KWS38IfbmbLPLZHhDiN::RepfdeCSHJ(System.Object,KWS38IfbmbLPLZHhDiN)
ldsfld pWkM9CfG6bCEmFAk2Hm pWkM9CfG6bCEmFAk2Hm::JimfR5qMp0
call System.Void pWkM9CfG6bCEmFAk2Hm::RepfdeCSHJ(System.Object,pWkM9CfG6bCEmFAk2Hm)
ldc.i4 2
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_3f1dd7e32d3b4a8292ff31f6c989c8ce
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_36b43d00aa1045ffb01ef3d5ee6c7949
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 5
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_9081a7dcf9ae4fab928a86b48c361d01
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld mW2Z4IfQj5OTBoRoXhC mW2Z4IfQj5OTBoRoXhC::tjTf39PoyT
call System.Void mW2Z4IfQj5OTBoRoXhC::RepfdeCSHJ(mW2Z4IfQj5OTBoRoXhC)
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_915698ee9a0d476a8dba65dfd53af4fd
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
Module Name
Qryii.exe
Full Name
Qryii.exe
EntryPoint
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Scope Name
Qryii.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qryii
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld Wus2Nbf6a8alMr0yrrk Wus2Nbf6a8alMr0yrrk::uYhf7lcVf5
call System.Byte[] Wus2Nbf6a8alMr0yrrk::RepfdeCSHJ(Wus2Nbf6a8alMr0yrrk)
stloc.s V_3
ldc.i4 6
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_f550602b1b8f48ad9c7aef104f249e30
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_011C: leave IL_0038
ldc.i4 -706789139
ldc.i4 -923518185
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_59fba2c14a5a43ddb78b95ce91a3583b
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
ldc.i4 -24527197
not <null>
ldc.i4 626417631
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_d09e13aa57df409a9bcae1a77764c9a3
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
newobj System.Void NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld iKk2akfjBE73xkeWwkJ iKk2akfjBE73xkeWwkJ::Wcuf4lLrvc
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy iKk2akfjBE73xkeWwkJ::RepfdeCSHJ(System.Object,System.Byte[],iKk2akfjBE73xkeWwkJ)
ldsfld KWS38IfbmbLPLZHhDiN KWS38IfbmbLPLZHhDiN::M0VfkOaCfj
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy KWS38IfbmbLPLZHhDiN::RepfdeCSHJ(System.Object,KWS38IfbmbLPLZHhDiN)
ldsfld pWkM9CfG6bCEmFAk2Hm pWkM9CfG6bCEmFAk2Hm::JimfR5qMp0
call System.Void pWkM9CfG6bCEmFAk2Hm::RepfdeCSHJ(System.Object,pWkM9CfG6bCEmFAk2Hm)
ldc.i4 2
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_3f1dd7e32d3b4a8292ff31f6c989c8ce
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_36b43d00aa1045ffb01ef3d5ee6c7949
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 5
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_9081a7dcf9ae4fab928a86b48c361d01
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld mW2Z4IfQj5OTBoRoXhC mW2Z4IfQj5OTBoRoXhC::tjTf39PoyT
call System.Void mW2Z4IfQj5OTBoRoXhC::RepfdeCSHJ(mW2Z4IfQj5OTBoRoXhC)
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_915698ee9a0d476a8dba65dfd53af4fd
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
773dda7eb9d848d9a3491ec2b61a9f0d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yAc9yLQmyMnG4Z5bJf.9sjNqE31WDD0ggrEse
xlYSrH6kF2jWByLEwU.SWZXAf7DZ67i8ciBuN
RPwt8w5dvvHoogpA77.I5lhOGZgG0W2dESOOG
qv4wWR2wFgQZwpj7rl.fNJwWx0LU3PnKhufxw
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙