Malicious
Malicious

8101494f7c085a3185df3f7dfc8ba430

PE Executable
MD5: 8101494f7c085a3185df3f7dfc8ba430
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8101494f7c085a3185df3f7dfc8ba430
Sha1 70c58d38e0fa9fe5ccb7c3ce5f400bad65c24219
Sha256 dc6c175fa649da5a41c2ec2f8c76156e53a2eb39b3df9f9d79952c417d76a65d
Sha384 8c1de350d4b8328181b0468030a772d895ea2e173b24e019d3cb5fe3095b242ad85e4929a69b8a45efbda3cd09bfadb4
Sha512 1e5a589dcdfd39823c994a02fec34073552ed65c12ac070ec3059f15c80b7831687031b94f8e07774bf58d93d93767dfa29ff779bd94204a6908ede0bbee049d
SSDeep 12288:k45GKkpAJy5+egTL+cqGngR+0yRAYAQece/SOwOcsT0JNjVJc7:xeFyhgRHyX9e1ascsANjVJ
TLSH B105AF3A32924E21C14A1373D1C6491197EA864776EBFB0B328513F61E4B3EEDE47297
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8101494f7c085a3185df3f7dfc8ba430
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Usti4OwBMfbFHm15bD.eoDOWoKL2yg4qOwcfg
D2W8YJY6O20LoR9538.fkH1WYsJj1s8KCETNf
C96NAwMkgPA1hUGu54.k2Hfx7LcIcGSrxaE0e
UfZStkZuppNPBEeFO9.shGCA1GkF7MX2IuTYj
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Sdgrrmpa.exe
Full Name
Sdgrrmpa.exe
EntryPoint
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Scope Name
Sdgrrmpa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sdgrrmpa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
ret <null>
ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
call System.Void MTLZx4kwsLUllUFmLJw::iGakiTyrM4(MTLZx4kwsLUllUFmLJw)
ldc.i4 5
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_604270babd6a4c0d85849f2e748111a5
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld rf5tWXkYikiLprn35UZ rf5tWXkYikiLprn35UZ::HUHks1C6Ak
call System.Byte[] rf5tWXkYikiLprn35UZ::iGakiTyrM4(rf5tWXkYikiLprn35UZ)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_4a03b87e69aa4b04acc50e078a2157ba
brtrue IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0144)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_0144: leave IL_0038
ldc.i4 -1748132686
ldc.i4 -1959779284
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_cebb9170fef3428cb5ebe04fbfd23c06
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
ldc.i4 -1928824495
ldc.i4 -1920460411
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_ab79028f024d430bb16836edf595076a
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
newobj System.Void wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Y8e31XklavCiZFYBWNS Y8e31XklavCiZFYBWNS::DQrk4oAnU1
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk Y8e31XklavCiZFYBWNS::iGakiTyrM4(System.Object,System.Byte[],Y8e31XklavCiZFYBWNS)
ldsfld edYBt4kR9kjhLr893Aj edYBt4kR9kjhLr893Aj::mfEkagl4Zl
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk edYBt4kR9kjhLr893Aj::iGakiTyrM4(System.Object,edYBt4kR9kjhLr893Aj)
ldsfld dPuEaYkXSZTmr3F3qL5 dPuEaYkXSZTmr3F3qL5::tupkgcJb8E
call System.Void dPuEaYkXSZTmr3F3qL5::iGakiTyrM4(System.Object,dPuEaYkXSZTmr3F3qL5)
ldc.i4 1
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_edc0ee9810624b15b1e5b9d7095f1b6b
brfalse IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_0144)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_5e2d34923b874f55a854010914bba796
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 1
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0177: ldloc V_0
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_87f56f787de1428c815185381dd5da93
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Sdgrrmpa.exe
Full Name
Sdgrrmpa.exe
EntryPoint
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Scope Name
Sdgrrmpa.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sdgrrmpa
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void esGUmstPOt5sVWiHds.zZOvidkOjMZwiOhUav::joGlu25cS()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
ret <null>
ldsfld MTLZx4kwsLUllUFmLJw MTLZx4kwsLUllUFmLJw::JRokKfaoLc
call System.Void MTLZx4kwsLUllUFmLJw::iGakiTyrM4(MTLZx4kwsLUllUFmLJw)
ldc.i4 5
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_604270babd6a4c0d85849f2e748111a5
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld rf5tWXkYikiLprn35UZ rf5tWXkYikiLprn35UZ::HUHks1C6Ak
call System.Byte[] rf5tWXkYikiLprn35UZ::iGakiTyrM4(rf5tWXkYikiLprn35UZ)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_4a03b87e69aa4b04acc50e078a2157ba
brtrue IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_0144)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_0144: leave IL_0038
ldc.i4 -1748132686
ldc.i4 -1959779284
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_cebb9170fef3428cb5ebe04fbfd23c06
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
ldc.i4 -1928824495
ldc.i4 -1920460411
xor <null>
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_ab79028f024d430bb16836edf595076a
xor <null>
ldsfld ppqfKqkkAwOHQdh8DuS ppqfKqkkAwOHQdh8DuS::g0tktgqxEw
call System.String ppqfKqkkAwOHQdh8DuS::iGakiTyrM4(System.Int32,ppqfKqkkAwOHQdh8DuS)
newobj System.Void wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Y8e31XklavCiZFYBWNS Y8e31XklavCiZFYBWNS::DQrk4oAnU1
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk Y8e31XklavCiZFYBWNS::iGakiTyrM4(System.Object,System.Byte[],Y8e31XklavCiZFYBWNS)
ldsfld edYBt4kR9kjhLr893Aj edYBt4kR9kjhLr893Aj::mfEkagl4Zl
call wZCbhsZ8wG5kD9fA0op.LbSUBPZigYvfMYColRk edYBt4kR9kjhLr893Aj::iGakiTyrM4(System.Object,edYBt4kR9kjhLr893Aj)
ldsfld dPuEaYkXSZTmr3F3qL5 dPuEaYkXSZTmr3F3qL5::tupkgcJb8E
call System.Void dPuEaYkXSZTmr3F3qL5::iGakiTyrM4(System.Object,dPuEaYkXSZTmr3F3qL5)
ldc.i4 1
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_edc0ee9810624b15b1e5b9d7095f1b6b
brfalse IL_00A0: switch(IL_00C0,IL_0144)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_0144)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_5e2d34923b874f55a854010914bba796
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 1
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0177: ldloc V_0
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147} <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_e44e1c1729154e21bf01eb019ab11e63
ldfld System.Int32 <Module>{e2354dfa-7ffd-4395-a9e7-2d80a9c12147}::m_87f56f787de1428c815185381dd5da93
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
8101494f7c085a3185df3f7dfc8ba430
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Usti4OwBMfbFHm15bD.eoDOWoKL2yg4qOwcfg
D2W8YJY6O20LoR9538.fkH1WYsJj1s8KCETNf
C96NAwMkgPA1hUGu54.k2Hfx7LcIcGSrxaE0e
UfZStkZuppNPBEeFO9.shGCA1GkF7MX2IuTYj
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙