Malicious
Malicious

8241127f4521046c5b38a78b7f5c94ab

PE Executable
MD5: 8241127f4521046c5b38a78b7f5c94ab
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8241127f4521046c5b38a78b7f5c94ab
Sha1 8cd75c44d701bf536b73f2156fadcf843e8a101d
Sha256 dc6790cdf758ba93696edf19d490d1fbb59a4312d456c77a498ccf3b955e1572
Sha384 8df9b39f9e4cbb77f2433ade62d12e8eaa635cb8be4d8e485778c1ca91fa1fbe0389a65ec8f1e8dea46dd55550cdc63d
Sha512 048c120f3f124a326b94bc2b01b402b1c4057d4cad326019e46c889ffd3871b4058ad1f44ef4ef2b0f951f3513d281d0fe54c14a3ecbee10e320ff9fa9c517aa
SSDeep 12288:U6r5wwNCBjbP8QkZBobbF6Cmu3YTHKu9IjiPJbw18HWKXx0mz:WlpsBot6Q3Y2u9mkJfH5xZ
TLSH 5B059E3A72914E12C24A13B3C1D74A0093A6D65777ABFB0F31C913DB19463EEEE06697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8241127f4521046c5b38a78b7f5c94ab
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YXlf5yEtjsbMEBJmXr.b0aVTX86K8F5PjK2PX
enx4dY0GrgcIpjJubh.UTvgd5NiW9O0CL1S2l
huko2ZgHyj8RnJrncK.q6dOPVLH7EqCIvhlTT
gDS3nfrAlQq27YYSEC.hwFeI75u8uKOYwhlsq
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Psmyy.exe
Full Name
Psmyy.exe
EntryPoint
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Scope Name
Psmyy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Psmyy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld PApmOHUE1HPx95LnIDQ PApmOHUE1HPx95LnIDQ::VJCU8hiaUk
call System.Byte[] PApmOHUE1HPx95LnIDQ::AZFU4Kyo2e(PApmOHUE1HPx95LnIDQ)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_db100eb2e3e3446f82b3f9a69bd317ed
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 144016953
ldc.i4 144016953
ldc.i4 790711922
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_9a680fbc0ede43b7800312d27c4361f8
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
ldc.i4 -1591469857
not <null>
ldc.i4 483187539
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_22aae9035a3c401bbf67928d6fafb97a
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
newobj System.Void qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld n6tpV3UIrSeRJwlg1ZS n6tpV3UIrSeRJwlg1ZS::QAkUbdx1hB
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN n6tpV3UIrSeRJwlg1ZS::AZFU4Kyo2e(System.Object,System.Byte[],n6tpV3UIrSeRJwlg1ZS)
ldsfld yLvwvDUJjOS9nwO8Ji0 yLvwvDUJjOS9nwO8Ji0::ObvUnY0js7
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN yLvwvDUJjOS9nwO8Ji0::AZFU4Kyo2e(System.Object,yLvwvDUJjOS9nwO8Ji0)
ldsfld cWJ7ZEUd07RRoKNPBCb cWJ7ZEUd07RRoKNPBCb::KfyUfdHBgU
call System.Void cWJ7ZEUd07RRoKNPBCb::AZFU4Kyo2e(System.Object,cWJ7ZEUd07RRoKNPBCb)
ldc.i4 7
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_cec4227e77f34697ab9d919d8a6a8f31
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_7ebac290e6164e87a1b309a45a9d2ed9
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 4
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_73c5c0082e0d4d469c74f33a52bee560
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld AJa6mCU02ae9yr7SMtZ AJa6mCU02ae9yr7SMtZ::jfYUNmjMjN
call System.Void AJa6mCU02ae9yr7SMtZ::AZFU4Kyo2e(AJa6mCU02ae9yr7SMtZ)
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_47a6a7f117f9466798cf6e485cba9b0a
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
Module Name
Psmyy.exe
Full Name
Psmyy.exe
EntryPoint
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Scope Name
Psmyy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Psmyy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld PApmOHUE1HPx95LnIDQ PApmOHUE1HPx95LnIDQ::VJCU8hiaUk
call System.Byte[] PApmOHUE1HPx95LnIDQ::AZFU4Kyo2e(PApmOHUE1HPx95LnIDQ)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_db100eb2e3e3446f82b3f9a69bd317ed
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 144016953
ldc.i4 144016953
ldc.i4 790711922
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_9a680fbc0ede43b7800312d27c4361f8
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
ldc.i4 -1591469857
not <null>
ldc.i4 483187539
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_22aae9035a3c401bbf67928d6fafb97a
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
newobj System.Void qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld n6tpV3UIrSeRJwlg1ZS n6tpV3UIrSeRJwlg1ZS::QAkUbdx1hB
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN n6tpV3UIrSeRJwlg1ZS::AZFU4Kyo2e(System.Object,System.Byte[],n6tpV3UIrSeRJwlg1ZS)
ldsfld yLvwvDUJjOS9nwO8Ji0 yLvwvDUJjOS9nwO8Ji0::ObvUnY0js7
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN yLvwvDUJjOS9nwO8Ji0::AZFU4Kyo2e(System.Object,yLvwvDUJjOS9nwO8Ji0)
ldsfld cWJ7ZEUd07RRoKNPBCb cWJ7ZEUd07RRoKNPBCb::KfyUfdHBgU
call System.Void cWJ7ZEUd07RRoKNPBCb::AZFU4Kyo2e(System.Object,cWJ7ZEUd07RRoKNPBCb)
ldc.i4 7
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_cec4227e77f34697ab9d919d8a6a8f31
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_7ebac290e6164e87a1b309a45a9d2ed9
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 4
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_73c5c0082e0d4d469c74f33a52bee560
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld AJa6mCU02ae9yr7SMtZ AJa6mCU02ae9yr7SMtZ::jfYUNmjMjN
call System.Void AJa6mCU02ae9yr7SMtZ::AZFU4Kyo2e(AJa6mCU02ae9yr7SMtZ)
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_47a6a7f117f9466798cf6e485cba9b0a
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
8241127f4521046c5b38a78b7f5c94ab
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YXlf5yEtjsbMEBJmXr.b0aVTX86K8F5PjK2PX
enx4dY0GrgcIpjJubh.UTvgd5NiW9O0CL1S2l
huko2ZgHyj8RnJrncK.q6dOPVLH7EqCIvhlTT
gDS3nfrAlQq27YYSEC.hwFeI75u8uKOYwhlsq
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙