Malicious
Malicious

77eb919ac3707bc58f178057a2c27a05

PE Executable
MD5: 77eb919ac3707bc58f178057a2c27a05
Size: 1.06 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.06 MB · 1,055,232 B
First seen
2026-07-30 15:01 · 2 months ago
Last seen
2026-07-30 15:01 · 2 months ago
Last analysis
2026-07-30 15:01 · 2 months ago
Hashes
MD5 77eb919ac3707bc58f178057a2c27a05 Sha1 78106530eef55bc0ac87e52d3a151c337663ca7a Sha256 9885939da17f13c0dbb0973bb0f8393f6170a8273da18bc7c31d9f88645985ce Sha384 b189663c5e4b83e0a9156574a9f98486190939bd3c20693ffca1af19dba28d93ba6a79f8cad53c4e77b9e5bb327a21b3 Sha512 ea020ec534d0b7d03bf8e5868ae2269ff553cdd939bf1becb9c0b4b2cba7736a5e5df351a366e9b0230e56fe4966fa2ac91b03acc9ee961e8ba27a189d6f65e8 SSDeep 24576:T92h70ZWNXmb1tg9ip0wZFBbW+Gz7N1auf+R7MS:mcbU9iphFU/2R7M TLSH 9D25C03A76928E21D24A5373C5C74D0087E79A87769BFB0B318423D71D433EEDA0A697
Detection
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Symbol obfuscation
Very high
1 malicious · 7 files
EXE77eb919ac3707bc58f178057a2c27a05
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINhOF7Fyeq9YF90v0eeL.e09lmQ2TCNE2WQsV4G
BINuElx10BsKykUuaXI4p.jI38AguiearqhK5UHx
BINg5dYb29FRHV0xYumtG.5WOxtE4quN2WSwswd2
BINsFUFfx55sMdcT018nr.3WTlvismODbhNGBb9f
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Sfocudrc.exe
Full Name
Sfocudrc.exe
EntryPoint
System.Void KiyKkv0UZfTFbg9qyo.rDQnkQvXcBsb2f734j::JbH63ZhL8()
Scope Name
Sfocudrc.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sfocudrc
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void KiyKkv0UZfTFbg9qyo.rDQnkQvXcBsb2f734j::JbH63ZhL8()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0061: nop
ldsfld UTJZd0veBVfJYY2B7di UTJZd0veBVfJYY2B7di::Erwv2IdlEf
call System.Void UTJZd0veBVfJYY2B7di::kBMvI07VPs(UTJZd0veBVfJYY2B7di)
ldc.i4 1
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_ffeba2ad6a094508bcbc36beebb9ae68
brtrue IL_0014: switch(IL_01BA,IL_0061,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_01BA,IL_0061,IL_0038)
nop <null>
ldsfld MR8LM6vBmB9tTTaWjGi MR8LM6vBmB9tTTaWjGi::tSovuDC26S
call System.Byte[] MR8LM6vBmB9tTTaWjGi::kBMvI07VPs(MR8LM6vBmB9tTTaWjGi)
stloc.s V_0
ldc.i4 6
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_59c7b3df7f384026b2b21d37f8072192
brfalse IL_009F: switch(IL_0143,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0143,IL_00BF)
br IL_009B: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009B: ldloc V_3
br IL_00BF: ldc.i4 -1888384149
ldc.i4 -1888384149
ldc.i4 -1273486473
xor <null>
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_3d9f1df7865344b98876ef3a09886482
xor <null>
ldsfld BKmUhLvvg8KnTTSb92H BKmUhLvvg8KnTTSb92H::fknv0C7Ab2
call System.String BKmUhLvvg8KnTTSb92H::kBMvI07VPs(System.Int32,BKmUhLvvg8KnTTSb92H)
ldc.i4 1069856539
ldc.i4 876877910
xor <null>
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_377fb5e905ae4897a6bcd1543e5ff71e
xor <null>
ldsfld BKmUhLvvg8KnTTSb92H BKmUhLvvg8KnTTSb92H::fknv0C7Ab2
call System.String BKmUhLvvg8KnTTSb92H::kBMvI07VPs(System.Int32,BKmUhLvvg8KnTTSb92H)
newobj System.Void MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld uefqrrv65DopFgZR3vN uefqrrv65DopFgZR3vN::rrnvo9a8Ig
call MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE uefqrrv65DopFgZR3vN::kBMvI07VPs(System.Object,System.Byte[],uefqrrv65DopFgZR3vN)
ldsfld wQYiuJvQSOA3wyxOM0m wQYiuJvQSOA3wyxOM0m::Jy0vCOZvFK
call MuAFEu5hlc59HRaiy4v.VI4FQW5IW8veAQ1b8jE wQYiuJvQSOA3wyxOM0m::kBMvI07VPs(System.Object,wQYiuJvQSOA3wyxOM0m)
ldsfld TT1neFvGSKZImFMtuGo TT1neFvGSKZImFMtuGo::UtmvL9jDPS
call System.Void TT1neFvGSKZImFMtuGo::kBMvI07VPs(System.Object,TT1neFvGSKZImFMtuGo)
ldc.i4 0
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_16fd945df41646289ea1c094ee91dbf7
brfalse IL_009F: switch(IL_0143,IL_00BF)
pop <null>
ldc.i4 2
br IL_009F: switch(IL_0143,IL_00BF)
leave IL_01BA: ret
pop <null>
ldc.i4 0
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_eeb4c478459b4300afe685f4aead94d7
brtrue IL_017A: switch(IL_0196)
pop <null>
ldc.i4 5
br IL_017A: switch(IL_0196)
br IL_0176: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0176: ldloc V_1
br IL_0196: leave IL_01BA
leave IL_01BA: ret
ldc.i4 0
ldsfld <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27} <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_6fbf91271f984686a338bc172ff227f3
ldfld System.Int32 <Module>{01827664-f272-4952-a4aa-f9bdbf65ce27}::m_777c7ff01d4e4ba788e84a95ccac2059
brfalse IL_0014: switch(IL_01BA,IL_0061,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_01BA,IL_0061,IL_0038)
ret <null>
1 malicious · 7 files
EXE77eb919ac3707bc58f178057a2c27a05
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙