77eb919ac3707bc58f178057a2c27a05

PE Executable

MD5: 77eb919ac3707bc58f178057a2c27a05

Size: 1.06 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	77eb919ac3707bc58f178057a2c27a05
Sha1	78106530eef55bc0ac87e52d3a151c337663ca7a
Sha256	9885939da17f13c0dbb0973bb0f8393f6170a8273da18bc7c31d9f88645985ce
Sha384	b189663c5e4b83e0a9156574a9f98486190939bd3c20693ffca1af19dba28d93ba6a79f8cad53c4e77b9e5bb327a21b3
Sha512	ea020ec534d0b7d03bf8e5868ae2269ff553cdd939bf1becb9c0b4b2cba7736a5e5df351a366e9b0230e56fe4966fa2ac91b03acc9ee961e8ba27a189d6f65e8
SSDeep	24576:T92h70ZWNXmb1tg9ip0wZFBbW+Gz7N1auf+R7MS:mcbU9iphFU/2R7M
TLSH	9D25C03A76928E21D24A5373C5C74D0087E79A87769BFB0B318423D71D433EEDA0A697

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Sfocudrc.exe
Full Name	Sfocudrc.exe
EntryPoint	System.Void KiyKkv0UZfTFbg9qyo.rDQnkQvXcBsb2f734j::JbH63ZhL8()
Scope Name	Sfocudrc.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Sfocudrc
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void KiyKkv0UZfTFbg9qyo.rDQnkQvXcBsb2f734j::JbH63ZhL8()
Main IL Instruction Count	97
Main IL	br.s IL_0007: ldc.i4 2 call <null> ldc.i4 2 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_0010: ldloc V_2 br IL_0061: nop ldsfld UTJZd0veBVfJYY2B7di UTJZd0veBVfJYY2B7di::Erwv2IdlEf call System.Void UTJZd0veBVfJYY2B7di::kBMvI07VPs(UTJZd0veBVfJYY2B7di) ldc.i4 1 ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_ffeba2ad6a094508bcbc36beebb9ae68 brtrue IL_0014: switch(IL_01BA,IL_0061,IL_0038) pop <null> ldc.i4 4 br IL_0014: switch(IL_01BA,IL_0061,IL_0038) nop <null> ldsfld MR8LM6vBmB9tTTaWjGi MR8LM6vBmB9tTTaWjGi::tSovuDC26S call System.Byte[] MR8LM6vBmB9tTTaWjGi::kBMvI07VPs(MR8LM6vBmB9tTTaWjGi) stloc.s V_0 ldc.i4 6 ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_59c7b3df7f384026b2b21d37f8072192 brfalse IL_009F: switch(IL_0143,IL_00BF) pop <null> ldc.i4 1 br IL_009F: switch(IL_0143,IL_00BF) br IL_009B: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 989 beq IL_009B: ldloc V_3 br IL_00BF: ldc.i4 -1888384149 ldc.i4 -1888384149 ldc.i4 -1273486473 xor <null> ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_3d9f1df7865344b98876ef3a09886482 xor <null> ldsfld BKmUhLvvg8KnTTSb92H BKmUhLvvg8KnTTSb92H::fknv0C7Ab2 call System.String BKmUhLvvg8KnTTSb92H::kBMvI07VPs(System.Int32,BKmUhLvvg8KnTTSb92H) ldc.i4 1069856539 ldc.i4 876877910 xor <null> ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_377fb5e905ae4897a6bcd1543e5ff71e xor <null> ldsfld BKmUhLvvg8KnTTSb92H BKmUhLvvg8KnTTSb92H::fknv0C7Ab2 call System.String BKmUhLvvg8KnTTSb92H::kBMvI07VPs(System.Int32,BKmUhLvvg8KnTTSb92H) newobj System.Void MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE::.ctor(System.String,System.String) ldloc.s V_0 ldsfld uefqrrv65DopFgZR3vN uefqrrv65DopFgZR3vN::rrnvo9a8Ig call MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE uefqrrv65DopFgZR3vN::kBMvI07VPs(System.Object,System.Byte[],uefqrrv65DopFgZR3vN) ldsfld wQYiuJvQSOA3wyxOM0m wQYiuJvQSOA3wyxOM0m::Jy0vCOZvFK call MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE wQYiuJvQSOA3wyxOM0m::kBMvI07VPs(System.Object,wQYiuJvQSOA3wyxOM0m) ldsfld TT1neFvGSKZImFMtuGo TT1neFvGSKZImFMtuGo::UtmvL9jDPS call System.Void TT1neFvGSKZImFMtuGo::kBMvI07VPs(System.Object,TT1neFvGSKZImFMtuGo) ldc.i4 0 ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_16fd945df41646289ea1c094ee91dbf7 brfalse IL_009F: switch(IL_0143,IL_00BF) pop <null> ldc.i4 2 br IL_009F: switch(IL_0143,IL_00BF) leave IL_01BA: ret pop <null> ldc.i4 0 ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_eeb4c478459b4300afe685f4aead94d7 brtrue IL_017A: switch(IL_0196) pop <null> ldc.i4 5 br IL_017A: switch(IL_0196) br IL_0176: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0176: ldloc V_1 br IL_0196: leave IL_01BA leave IL_01BA: ret ldc.i4 0 ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3 ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_777c7ff01d4e4ba788e84a95ccac2059 brfalse IL_0014: switch(IL_01BA,IL_0061,IL_0038) pop <null> ldc.i4 6 br IL_0014: switch(IL_01BA,IL_0061,IL_0038) ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.