Malicious
Malicious

7a436940373475bd5be44a654879ca8e

PE Executable
MD5: 7a436940373475bd5be44a654879ca8e
Size: 429.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
429.06 KB · 429,056 B
First seen
2026-09-09 17:45 · one month ago
Last seen
2026-09-09 17:45 · one month ago
Last analysis
2026-09-09 17:45 · one month ago
Hashes
MD5 7a436940373475bd5be44a654879ca8e Sha1 506b8cdc3d08e6d1f5515a72287e641508be4a44 Sha256 a9f49d8d36e1cae8c15426b1cd0b71453f0f2196e5c9f6a084b1e56c18fa63e5 Sha384 b147bc0b6145a1e85f368f8117fca1c0e2cbdca0d4fbf072fc6ce5b6fe56a1083d0026c6d6e91a3ef030481d830e03d8 Sha512 a0ec41383d510ec8300d98b6b5e49d7d37ca4a3b2232dc2b1cab3c86395a703cdd466cef2510c573e62b7cefaff48d96205b60ed35d0c01e87368f9b6d9d893b SSDeep 6144:nJVF0R+jMp4b820Bt7iuDzARK/ysbdEaGi:nHSR+W4420rWuDrJx TLSH 40943A3B72914E21C2C64372C1CB590083AA96577AABF70F31C613D619473EEDA4A7DB
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE7a436940373475bd5be44a654879ca8e
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BIN5JAMJnbbq1l45H01SQ.PgPuJ9Nw7Tau5qj7qe
BINPKOgaG5G4lIsivkCWP.WbN1Fqh9cMC1ciqhHg
BINap55pfSRcKDy2HdkD8.9VHc0ZieVGgWMJXc33
BINB8FHqv9D9KtfuN59sl.Ls2Ys4D3CUjAaaNmcU
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Kmjzduu.exe
Full Name
Kmjzduu.exe
EntryPoint
System.Void aLN71vuVkltdiuVN8Q.QRXSWJq8E0ssFDIAeh::l8IWuIXY8()
Scope Name
Kmjzduu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Kmjzduu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aLN71vuVkltdiuVN8Q.QRXSWJq8E0ssFDIAeh::l8IWuIXY8()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01C6: ret
nop <null>
ldsfld r75yvGqb114ZmtDJ8aT r75yvGqb114ZmtDJ8aT::F1QqN5daOQ
call System.Byte[] r75yvGqb114ZmtDJ8aT::qtTqHFMJYp(r75yvGqb114ZmtDJ8aT)
stloc.s V_0
ldc.i4 2
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_9b5a3cbfaafa4a549a36063ec619ea28
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0126: leave IL_01C6
ldc.i4 685548330
ldc.i4 3
shr <null>
ldc.i4 1200830218
xor <null>
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d85606bbc9ff46d58f02a8a6f3e754bf
xor <null>
ldsfld VqtH42qqB6Tqajyuh3r VqtH42qqB6Tqajyuh3r::Susqu174LW
call System.String VqtH42qqB6Tqajyuh3r::qtTqHFMJYp(System.Int32,VqtH42qqB6Tqajyuh3r)
ldc.i4 -502408770
ldc.i4 357135216
xor <null>
ldc.i4 -1407916762
xor <null>
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d6b56e6ca34646bda742e99af7c17947
xor <null>
ldsfld VqtH42qqB6Tqajyuh3r VqtH42qqB6Tqajyuh3r::Susqu174LW
call System.String VqtH42qqB6Tqajyuh3r::qtTqHFMJYp(System.Int32,VqtH42qqB6Tqajyuh3r)
newobj System.Void naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld hnSSa5qWsUgbdlXYvnb hnSSa5qWsUgbdlXYvnb::HDXqmpbDsi
call naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2 hnSSa5qWsUgbdlXYvnb::qtTqHFMJYp(System.Object,System.Byte[],hnSSa5qWsUgbdlXYvnb)
ldsfld J8bZTAqRgiGJrioygnW J8bZTAqRgiGJrioygnW::oQXqPR0eBs
call naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2 J8bZTAqRgiGJrioygnW::qtTqHFMJYp(System.Object,J8bZTAqRgiGJrioygnW)
ldsfld Mr3DoJqJbJ5Wx0hDTFF Mr3DoJqJbJ5Wx0hDTFF::rkPqgiV9Oc
call System.Void Mr3DoJqJbJ5Wx0hDTFF::qtTqHFMJYp(System.Object,Mr3DoJqJbJ5Wx0hDTFF)
ldc.i4 1
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_c1714751b031465484a4218587267868
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 1
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_cb27bf84e6074a7d885eddcbd3cc9459
brfalse IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0159: ldloc V_2
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 7
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_c9ca4553f00e49c9afb338738c71a192
brtrue IL_0014: switch(IL_0038,IL_019D,IL_01C6)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_019D,IL_01C6)
ldsfld NPvgefqSC2RunObQyAv NPvgefqSC2RunObQyAv::yXoqiFtesW
call System.Void NPvgefqSC2RunObQyAv::qtTqHFMJYp(NPvgefqSC2RunObQyAv)
ldc.i4 0
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d7d1e4850c534d5f9d01443cd16a3c5e
brtrue IL_0014: switch(IL_0038,IL_019D,IL_01C6)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_019D,IL_01C6)
ret <null>
Module Name
Kmjzduu.exe
Full Name
Kmjzduu.exe
EntryPoint
System.Void aLN71vuVkltdiuVN8Q.QRXSWJq8E0ssFDIAeh::l8IWuIXY8()
Scope Name
Kmjzduu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Kmjzduu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aLN71vuVkltdiuVN8Q.QRXSWJq8E0ssFDIAeh::l8IWuIXY8()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_01C6: ret
nop <null>
ldsfld r75yvGqb114ZmtDJ8aT r75yvGqb114ZmtDJ8aT::F1QqN5daOQ
call System.Byte[] r75yvGqb114ZmtDJ8aT::qtTqHFMJYp(r75yvGqb114ZmtDJ8aT)
stloc.s V_0
ldc.i4 2
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_9b5a3cbfaafa4a549a36063ec619ea28
brtrue IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_0126)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0126: leave IL_01C6
ldc.i4 685548330
ldc.i4 3
shr <null>
ldc.i4 1200830218
xor <null>
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d85606bbc9ff46d58f02a8a6f3e754bf
xor <null>
ldsfld VqtH42qqB6Tqajyuh3r VqtH42qqB6Tqajyuh3r::Susqu174LW
call System.String VqtH42qqB6Tqajyuh3r::qtTqHFMJYp(System.Int32,VqtH42qqB6Tqajyuh3r)
ldc.i4 -502408770
ldc.i4 357135216
xor <null>
ldc.i4 -1407916762
xor <null>
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d6b56e6ca34646bda742e99af7c17947
xor <null>
ldsfld VqtH42qqB6Tqajyuh3r VqtH42qqB6Tqajyuh3r::Susqu174LW
call System.String VqtH42qqB6Tqajyuh3r::qtTqHFMJYp(System.Int32,VqtH42qqB6Tqajyuh3r)
newobj System.Void naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld hnSSa5qWsUgbdlXYvnb hnSSa5qWsUgbdlXYvnb::HDXqmpbDsi
call naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2 hnSSa5qWsUgbdlXYvnb::qtTqHFMJYp(System.Object,System.Byte[],hnSSa5qWsUgbdlXYvnb)
ldsfld J8bZTAqRgiGJrioygnW J8bZTAqRgiGJrioygnW::oQXqPR0eBs
call naTOCb9OZd55m4r1a0N.YM8kte9HXpauMfgOKZ2 J8bZTAqRgiGJrioygnW::qtTqHFMJYp(System.Object,J8bZTAqRgiGJrioygnW)
ldsfld Mr3DoJqJbJ5Wx0hDTFF Mr3DoJqJbJ5Wx0hDTFF::rkPqgiV9Oc
call System.Void Mr3DoJqJbJ5Wx0hDTFF::qtTqHFMJYp(System.Object,Mr3DoJqJbJ5Wx0hDTFF)
ldc.i4 1
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_c1714751b031465484a4218587267868
brfalse IL_0076: switch(IL_0096,IL_0126)
pop <null>
ldc.i4 3
br IL_0076: switch(IL_0096,IL_0126)
leave IL_01C6: ret
pop <null>
ldc.i4 1
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_cb27bf84e6074a7d885eddcbd3cc9459
brfalse IL_015D: switch(IL_0179)
pop <null>
ldc.i4 0
br IL_015D: switch(IL_0179)
br IL_0159: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0159: ldloc V_2
br IL_0179: leave IL_01C6
leave IL_01C6: ret
ldc.i4 7
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_c9ca4553f00e49c9afb338738c71a192
brtrue IL_0014: switch(IL_0038,IL_019D,IL_01C6)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_019D,IL_01C6)
ldsfld NPvgefqSC2RunObQyAv NPvgefqSC2RunObQyAv::yXoqiFtesW
call System.Void NPvgefqSC2RunObQyAv::qtTqHFMJYp(NPvgefqSC2RunObQyAv)
ldc.i4 0
ldsfld <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9} <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_644ef63b93fc415eb147d8885add95b8
ldfld System.Int32 <Module>{4d6c5daf-0cbf-406f-ae31-c12cb78625a9}::m_d7d1e4850c534d5f9d01443cd16a3c5e
brtrue IL_0014: switch(IL_0038,IL_019D,IL_01C6)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_019D,IL_01C6)
ret <null>
1 malicious · 7 files
EXE7a436940373475bd5be44a654879ca8e
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙