Deep Malware Analysis of 805c932c27edd7b4c867ff7a126a521f | md5: 805c932c27edd7b4c867ff7a126a521f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.92

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	805c932c27edd7b4c867ff7a126a521f
Sha1	a6730aa987e031a7cad36685e9b503cf33cb9c2a
Sha256	19a6e12ceab0ba0876c12b273d743407a04ca864671978bd0e21db44b8c6e0f7
Sha384	a6fe37901b9cc122342a4a4697c2b82a427b5f8763e8addbd7de072eb9ee0d686503b30b6d746f4b3dd9acf3f61fba96
Sha512	7846164fc6872660f1e85c9aa834472873c3242cb111384da1a31fd58b17e01c407114e912275ddd15f9e6f46f44189dde8b826a2e69cdf7aa882d74df4253ce
SSDeep	24576:3mXHIkrTqfyuCZEXmQjAHJEy4pLvVjfIJF:zcexCZQcHyy4HI
TLSH	1405BF6A36514E50C6890B73C08B960083E2A686FAF7F30F724413A55D973FED94B7A7

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Fnqepdkv.exe
Full Name	Fnqepdkv.exe
EntryPoint	System.Void o8tw5F0jGh9gg9H2ky.VOCLv4eKRXaFyolE6d::Xn5SdZaQp()
Scope Name	Fnqepdkv.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Fnqepdkv
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void o8tw5F0jGh9gg9H2ky.VOCLv4eKRXaFyolE6d::Xn5SdZaQp()
Main IL Instruction Count	96
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_0010: ldloc V_2 br IL_01B1: ret nop <null> ldsfld g4TPLVeB9UCBJv8c4SF g4TPLVeB9UCBJv8c4SF::hAUeAxxhMX call System.Byte[] g4TPLVeB9UCBJv8c4SF::I5neTZtwO2(g4TPLVeB9UCBJv8c4SF) stloc.s V_1 ldc.i4 0 ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_3045ba72075c4eed8978b8f869c6566f brfalse IL_0076: switch(IL_0096,IL_0111) pop <null> ldc.i4 6 br IL_0076: switch(IL_0096,IL_0111) br IL_0072: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0072: ldloc V_0 br IL_0111: leave IL_01B1 ldc.i4 -629122282 ldc.i4 1 shr <null> ldc.i4 -782812388 xor <null> ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_b660cb300c77433ea9190b2e33c5242b xor <null> ldsfld VcOx4XeEnsSFd8gnpEK VcOx4XeEnsSFd8gnpEK::n0AeceYSuy call System.String VcOx4XeEnsSFd8gnpEK::I5neTZtwO2(System.Int32,VcOx4XeEnsSFd8gnpEK) ldc.i4 -1512538210 ldc.i4 -804879734 xor <null> ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_582b8340ee62415da10e6f7c090691e0 xor <null> ldsfld VcOx4XeEnsSFd8gnpEK VcOx4XeEnsSFd8gnpEK::n0AeceYSuy call System.String VcOx4XeEnsSFd8gnpEK::I5neTZtwO2(System.Int32,VcOx4XeEnsSFd8gnpEK) newobj System.Void fdBpgStFmEY7tWE5kI.RNVHuZwGx18pyhLYNQ::.ctor(System.String,System.String) newobj System.Void gb65WGJ68t4H95LxyuP.WitPNiJ8N3f1KbX5AtP::.ctor(fdBpgStFmEY7tWE5kI.RNVHuZwGx18pyhLYNQ) ldloc.s V_1 ldsfld ob4IMpeVY655LIhBYVa ob4IMpeVY655LIhBYVa::hmGezQFqol call System.Void ob4IMpeVY655LIhBYVa::I5neTZtwO2(System.Object,System.Byte[],ob4IMpeVY655LIhBYVa) ldc.i4 0 ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_6d0c728f86cb4041a77d32a3e4e1c402 brfalse IL_0076: switch(IL_0096,IL_0111) pop <null> ldc.i4 1 br IL_0076: switch(IL_0096,IL_0111) leave IL_01B1: ret pop <null> ldc.i4 0 ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_c9a603ad07c248b98a40cd6e86bfa3e6 brfalse IL_0148: switch(IL_0164) pop <null> ldc.i4 6 br IL_0148: switch(IL_0164) br IL_0144: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 988 beq IL_0144: ldloc V_3 br IL_0164: leave IL_01B1 leave IL_01B1: ret ldc.i4 2 ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_b277400714114128a237f4c41f1b3934 brfalse IL_0014: switch(IL_0038,IL_0188,IL_01B1) pop <null> ldc.i4 4 br IL_0014: switch(IL_0038,IL_0188,IL_01B1) ldsfld rU5uwJePpmORtvcHOyM rU5uwJePpmORtvcHOyM::MDceDx5NIy call System.Void rU5uwJePpmORtvcHOyM::I5neTZtwO2(rU5uwJePpmORtvcHOyM) ldc.i4 0 ldsfld <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901} <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2eda7b8c5196470a8edbf4396db92c7b ldfld System.Int32 <Module>{13e3eeb4-c84b-4892-bed8-3164ff2d4901}::m_2be3352c557c4edeae0c09dcf8afc036 brtrue IL_0014: switch(IL_0038,IL_0188,IL_01B1) pop <null> ldc.i4 4 br IL_0014: switch(IL_0038,IL_0188,IL_01B1) ret <null>