Malicious
Malicious

773dda7eb9d848d9a3491ec2b61a9f0d

Share on LinkedIn
Print
PE Executable
MD5: 773dda7eb9d848d9a3491ec2b61a9f0d
Size: 829.44 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 773dda7eb9d848d9a3491ec2b61a9f0d
Sha1 b6b659b8e152bb1f8d9fc954b68b4542fe256530
Sha256 b366811f3f74717395eddf884e59b329cf192d2a310cf47deadbf4102ef71e67
Sha384 5bc5a23d485e63690af71ad8326f46ab3b26118f94fe67f4f0613fd4b7b88c8ad8cdce0af0b3c895207ddcf60f61a175
Sha512 e723096e8709c6adcd27f02108fb88415f2e45438ce689a865606a317f36174de52bf7c6dfd6a126f9e9a5c740d4ac411bf9e74eb7bd8dfb0d118f87c5d346fe
SSDeep 12288:AdbczmATrCby9KwYzPo9SgCEix/QAh3TgN+18ehFlP9HR2IVY5xd:Us+by9VYoRCEi9ddTgcKedP91yZ
TLSH AD05BE3B32A18F25C1864373C1C3590197AA8A4B36EBEB0B35C513D619467FEDE4A397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
773dda7eb9d848d9a3491ec2b61a9f0d
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yAc9yLQmyMnG4Z5bJf.9sjNqE31WDD0ggrEse
xlYSrH6kF2jWByLEwU.SWZXAf7DZ67i8ciBuN
RPwt8w5dvvHoogpA77.I5lhOGZgG0W2dESOOG
qv4wWR2wFgQZwpj7rl.fNJwWx0LU3PnKhufxw
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qryii.exe
Full Name
Qryii.exe
EntryPoint
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Scope Name
Qryii.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qryii
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld Wus2Nbf6a8alMr0yrrk Wus2Nbf6a8alMr0yrrk::uYhf7lcVf5
call System.Byte[] Wus2Nbf6a8alMr0yrrk::RepfdeCSHJ(Wus2Nbf6a8alMr0yrrk)
stloc.s V_3
ldc.i4 6
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_f550602b1b8f48ad9c7aef104f249e30
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_011C: leave IL_0038
ldc.i4 -706789139
ldc.i4 -923518185
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_59fba2c14a5a43ddb78b95ce91a3583b
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
ldc.i4 -24527197
not <null>
ldc.i4 626417631
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_d09e13aa57df409a9bcae1a77764c9a3
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
newobj System.Void NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld iKk2akfjBE73xkeWwkJ iKk2akfjBE73xkeWwkJ::Wcuf4lLrvc
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy iKk2akfjBE73xkeWwkJ::RepfdeCSHJ(System.Object,System.Byte[],iKk2akfjBE73xkeWwkJ)
ldsfld KWS38IfbmbLPLZHhDiN KWS38IfbmbLPLZHhDiN::M0VfkOaCfj
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy KWS38IfbmbLPLZHhDiN::RepfdeCSHJ(System.Object,KWS38IfbmbLPLZHhDiN)
ldsfld pWkM9CfG6bCEmFAk2Hm pWkM9CfG6bCEmFAk2Hm::JimfR5qMp0
call System.Void pWkM9CfG6bCEmFAk2Hm::RepfdeCSHJ(System.Object,pWkM9CfG6bCEmFAk2Hm)
ldc.i4 2
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_3f1dd7e32d3b4a8292ff31f6c989c8ce
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_36b43d00aa1045ffb01ef3d5ee6c7949
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 5
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_9081a7dcf9ae4fab928a86b48c361d01
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld mW2Z4IfQj5OTBoRoXhC mW2Z4IfQj5OTBoRoXhC::tjTf39PoyT
call System.Void mW2Z4IfQj5OTBoRoXhC::RepfdeCSHJ(mW2Z4IfQj5OTBoRoXhC)
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_915698ee9a0d476a8dba65dfd53af4fd
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
Module Name
Qryii.exe
Full Name
Qryii.exe
EntryPoint
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Scope Name
Qryii.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qryii
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void TbgtSqPTI7BrHM3JJn.DKyN3MfDsGJ3YxCO7j::sDHjOEO2Z()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld Wus2Nbf6a8alMr0yrrk Wus2Nbf6a8alMr0yrrk::uYhf7lcVf5
call System.Byte[] Wus2Nbf6a8alMr0yrrk::RepfdeCSHJ(Wus2Nbf6a8alMr0yrrk)
stloc.s V_3
ldc.i4 6
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_f550602b1b8f48ad9c7aef104f249e30
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0073: ldloc V_1
br IL_011C: leave IL_0038
ldc.i4 -706789139
ldc.i4 -923518185
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_59fba2c14a5a43ddb78b95ce91a3583b
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
ldc.i4 -24527197
not <null>
ldc.i4 626417631
xor <null>
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_d09e13aa57df409a9bcae1a77764c9a3
xor <null>
ldsfld Sh7G43ffjjmBR7L5YCi Sh7G43ffjjmBR7L5YCi::p8gfPhHXQo
call System.String Sh7G43ffjjmBR7L5YCi::RepfdeCSHJ(System.Int32,Sh7G43ffjjmBR7L5YCi)
newobj System.Void NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld iKk2akfjBE73xkeWwkJ iKk2akfjBE73xkeWwkJ::Wcuf4lLrvc
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy iKk2akfjBE73xkeWwkJ::RepfdeCSHJ(System.Object,System.Byte[],iKk2akfjBE73xkeWwkJ)
ldsfld KWS38IfbmbLPLZHhDiN KWS38IfbmbLPLZHhDiN::M0VfkOaCfj
call NxdlAp2eyWZfjIVQAIW.WSubJJ2d9NxpcCW1Cuy KWS38IfbmbLPLZHhDiN::RepfdeCSHJ(System.Object,KWS38IfbmbLPLZHhDiN)
ldsfld pWkM9CfG6bCEmFAk2Hm pWkM9CfG6bCEmFAk2Hm::JimfR5qMp0
call System.Void pWkM9CfG6bCEmFAk2Hm::RepfdeCSHJ(System.Object,pWkM9CfG6bCEmFAk2Hm)
ldc.i4 2
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_3f1dd7e32d3b4a8292ff31f6c989c8ce
brtrue IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_36b43d00aa1045ffb01ef3d5ee6c7949
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 5
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_9081a7dcf9ae4fab928a86b48c361d01
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld mW2Z4IfQj5OTBoRoXhC mW2Z4IfQj5OTBoRoXhC::tjTf39PoyT
call System.Void mW2Z4IfQj5OTBoRoXhC::RepfdeCSHJ(mW2Z4IfQj5OTBoRoXhC)
ldc.i4 0
ldsfld <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5} <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_178de57808b0430ab15fe5438aeffde4
ldfld System.Int32 <Module>{8063d755-950a-4bfd-abd2-e70d0bd147d5}::m_915698ee9a0d476a8dba65dfd53af4fd
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙