.NET Reflective Loader malware analysis – 08954f944623

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

751.1 KB · 751,104 B

First seen

2026-10-09 12:00 · 16 days ago

Last seen

2026-10-09 12:00 · 16 days ago

Last analysis

2026-10-09 12:00 · 16 days ago

Hashes

MD5 7a35065b803f6f05dbce13ff68e1f815 Sha1 c48a0969272a06ebd79066a6523f14a194229168 Sha256 08954f9446234a2fafe12537884cfd684df960b6d28527f6777248518ab7e526 Sha384 29b7d6371658c827aa34368d639d7b2507b78779778ce670cb5a047a3bbda9e452c8488db9664ebfd8f7b0a4e23f8b1b Sha512 06b289cfc090aebc63e627cee1950ceaa9def8f8b426bb83c950176c07df282f634b6fa660a6e0a226aed9e4c2e68e962c5ee0c644166ef9da97420bdabac2a1 SSDeep 12288:d8ZR1PPXQhNfBYXSpeK05VavMC+Z/wx3zA4ecEp+dOAWmVrm34bkbV4fSOeO1t/I:6dPXQNfhAtVa3+ZoxjAjDpTAWaaqB15I TLSH 41F4D06523E46AB0F9BFAB74A57110048BF6F842D735DA5E6D6460ED1930F809AE3333

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

2 malicious · 12 files

EXE7a35065b803f6f05dbce13ff68e1f815.NET Reflective Loader

Structure

BINResources

BIN.Net Resources

BIN.Net Reflective Loader

JSDmp39mW.g.resources [AES Decrypted]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	Dmp39mW
Full Name	Dmp39mW
EntryPoint	System.Void Dmp39mW.Dbd12BtfKt3c/xj5Xt.Zak29::Aqx50NnpxwG12()
Scope Name	Dmp39mW
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Dmp39mW
Assembly Version	23.20.4.295
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1363
Main Method	System.Void Dmp39mW.Dbd12BtfKt3c/xj5Xt.Zak29::Aqx50NnpxwG12()
Main IL Instruction Count	8
Main IL	`nop <null> ldloca.s V_0 initobj System.Windows.Forms.ImeModeConversion newobj System.Void System.Object::.ctor() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Void Dmp39mW.ReverberationTimeMeasurement.Goj9oQ2::wKy4s7Yaye6Zr(System.Object) nop <null> ret <null>`
Module Name	Dmp39mW
Full Name	Dmp39mW
EntryPoint	System.Void Dmp39mW.Dbd12BtfKt3c/xj5Xt.Zak29::Aqx50NnpxwG12()
Scope Name	Dmp39mW
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Dmp39mW
Assembly Version	23.20.4.295
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1363
Main Method	System.Void Dmp39mW.Dbd12BtfKt3c/xj5Xt.Zak29::Aqx50NnpxwG12()
Main IL Instruction Count	8
Main IL	`nop <null> ldloca.s V_0 initobj System.Windows.Forms.ImeModeConversion newobj System.Void System.Object::.ctor() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Void Dmp39mW.ReverberationTimeMeasurement.Goj9oQ2::wKy4s7Yaye6Zr(System.Object) nop <null> ret <null>`