Malicious
Malicious

8101494f7c085a3185df3f7dfc8ba430

PE Executable
MD5: 8101494f7c085a3185df3f7dfc8ba430
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
828.42 KB · 828,416 B
Hashes
MD5 8101494f7c085a3185df3f7dfc8ba430 Sha1 70c58d38e0fa9fe5ccb7c3ce5f400bad65c24219 Sha256 dc6c175fa649da5a41c2ec2f8c76156e53a2eb39b3df9f9d79952c417d76a65d Sha384 8c1de350d4b8328181b0468030a772d895ea2e173b24e019d3cb5fe3095b242ad85e4929a69b8a45efbda3cd09bfadb4 Sha512 1e5a589dcdfd39823c994a02fec34073552ed65c12ac070ec3059f15c80b7831687031b94f8e07774bf58d93d93767dfa29ff779bd94204a6908ede0bbee049d SSDeep 12288:k45GKkpAJy5+egTL+cqGngR+0yRAYAQece/SOwOcsT0JNjVJc7:xeFyhgRHyX9e1ascsANjVJ TLSH B105AF3A32924E21C14A1373D1C6491197EA864776EBFB0B328513F61E4B3EEDE47297
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE8101494f7c085a3185df3f7dfc8ba430
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINUsti4OwBMfbFHm15bD.eoDOWoKL2yg4qOwcfg
BIND2W8YJY6O20LoR9538.fkH1WYsJj1s8KCETNf
BINC96NAwMkgPA1hUGu54.k2Hfx7LcIcGSrxaE0e
BINUfZStkZuppNPBEeFO9.shGCA1GkF7MX2IuTYj
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Sdgrrmpa.exe
Full Name
Sdgrrmpa.exe
EntryPoint
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Scope Name
Sdgrrmpa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sdgrrmpa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
ret <null>
ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
call System.Void MTLZx4kwsLUllUFmLJw::iGakiTyrM4(MTLZx4kwsLUllUFmLJw)
ldc.i4 5
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_604270babd6a4c0d85849f2e748111a5
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld rf5tWXkYikiLprn35UZ rf5tWXkYikiLprn35UZ::HUHks1C6Ak
call System.Byte[] rf5tWXkYikiLprn35UZ::iGakiTyrM4(rf5tWXkYikiLprn35UZ)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_4a03b87e69aa4b04acc50e078a2157ba
brtrue IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0144)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_0144: leave IL_0038
ldc.i4 -1748132686
ldc.i4 -1959779284
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_cebb9170fef3428cb5ebe04fbfd23c06
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
ldc.i4 -1928824495
ldc.i4 -1920460411
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_ab79028f024d430bb16836edf595076a
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
newobj System.Void wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Y8e31XklavCiZFYBWNS Y8e31XklavCiZFYBWNS::DQrk4oAnU1
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk Y8e31XklavCiZFYBWNS::iGakiTyrM4(System.Object,System.Byte[],Y8e31XklavCiZFYBWNS)
ldsfld edYBt4kR9kjhLr893Aj edYBt4kR9kjhLr893Aj::mfEkagl4Zl
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk edYBt4kR9kjhLr893Aj::iGakiTyrM4(System.Object,edYBt4kR9kjhLr893Aj)
ldsfld dPuEaYkXSZTmr3F3qL5 dPuEaYkXSZTmr3F3qL5::tupkgcJb8E
call System.Void dPuEaYkXSZTmr3F3qL5::iGakiTyrM4(System.Object,dPuEaYkXSZTmr3F3qL5)
ldc.i4 1
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_edc0ee9810624b15b1e5b9d7095f1b6b
brfalse IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_0144)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_5e2d34923b874f55a854010914bba796
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 1
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0177: ldloc V_0
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_87f56f787de1428c815185381dd5da93
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Sdgrrmpa.exe
Full Name
Sdgrrmpa.exe
EntryPoint
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Scope Name
Sdgrrmpa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sdgrrmpa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
ret <null>
ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
call System.Void MTLZx4kwsLUllUFmLJw::iGakiTyrM4(MTLZx4kwsLUllUFmLJw)
ldc.i4 5
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_604270babd6a4c0d85849f2e748111a5
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld rf5tWXkYikiLprn35UZ rf5tWXkYikiLprn35UZ::HUHks1C6Ak
call System.Byte[] rf5tWXkYikiLprn35UZ::iGakiTyrM4(rf5tWXkYikiLprn35UZ)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_4a03b87e69aa4b04acc50e078a2157ba
brtrue IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0144)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_0144: leave IL_0038
ldc.i4 -1748132686
ldc.i4 -1959779284
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_cebb9170fef3428cb5ebe04fbfd23c06
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
ldc.i4 -1928824495
ldc.i4 -1920460411
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_ab79028f024d430bb16836edf595076a
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
newobj System.Void wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Y8e31XklavCiZFYBWNS Y8e31XklavCiZFYBWNS::DQrk4oAnU1
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk Y8e31XklavCiZFYBWNS::iGakiTyrM4(System.Object,System.Byte[],Y8e31XklavCiZFYBWNS)
ldsfld edYBt4kR9kjhLr893Aj edYBt4kR9kjhLr893Aj::mfEkagl4Zl
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk edYBt4kR9kjhLr893Aj::iGakiTyrM4(System.Object,edYBt4kR9kjhLr893Aj)
ldsfld dPuEaYkXSZTmr3F3qL5 dPuEaYkXSZTmr3F3qL5::tupkgcJb8E
call System.Void dPuEaYkXSZTmr3F3qL5::iGakiTyrM4(System.Object,dPuEaYkXSZTmr3F3qL5)
ldc.i4 1
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_edc0ee9810624b15b1e5b9d7095f1b6b
brfalse IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_0144)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_5e2d34923b874f55a854010914bba796
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 1
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0177: ldloc V_0
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_87f56f787de1428c815185381dd5da93
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
1 malicious · 7 files
EXE8101494f7c085a3185df3f7dfc8ba430
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙