Malicious
Malicious

8241127f4521046c5b38a78b7f5c94ab

Share on LinkedIn
Print
PE Executable
MD5: 8241127f4521046c5b38a78b7f5c94ab
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8241127f4521046c5b38a78b7f5c94ab
Sha1 8cd75c44d701bf536b73f2156fadcf843e8a101d
Sha256 dc6790cdf758ba93696edf19d490d1fbb59a4312d456c77a498ccf3b955e1572
Sha384 8df9b39f9e4cbb77f2433ade62d12e8eaa635cb8be4d8e485778c1ca91fa1fbe0389a65ec8f1e8dea46dd55550cdc63d
Sha512 048c120f3f124a326b94bc2b01b402b1c4057d4cad326019e46c889ffd3871b4058ad1f44ef4ef2b0f951f3513d281d0fe54c14a3ecbee10e320ff9fa9c517aa
SSDeep 12288:U6r5wwNCBjbP8QkZBobbF6Cmu3YTHKu9IjiPJbw18HWKXx0mz:WlpsBot6Q3Y2u9mkJfH5xZ
TLSH 5B059E3A72914E12C24A13B3C1D74A0093A6D65777ABFB0F31C913DB19463EEEE06697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8241127f4521046c5b38a78b7f5c94ab
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YXlf5yEtjsbMEBJmXr.b0aVTX86K8F5PjK2PX
enx4dY0GrgcIpjJubh.UTvgd5NiW9O0CL1S2l
huko2ZgHyj8RnJrncK.q6dOPVLH7EqCIvhlTT
gDS3nfrAlQq27YYSEC.hwFeI75u8uKOYwhlsq
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Psmyy.exe
Full Name
Psmyy.exe
EntryPoint
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Scope Name
Psmyy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Psmyy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld PApmOHUE1HPx95LnIDQ PApmOHUE1HPx95LnIDQ::VJCU8hiaUk
call System.Byte[] PApmOHUE1HPx95LnIDQ::AZFU4Kyo2e(PApmOHUE1HPx95LnIDQ)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_db100eb2e3e3446f82b3f9a69bd317ed
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 144016953
ldc.i4 144016953
ldc.i4 790711922
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_9a680fbc0ede43b7800312d27c4361f8
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
ldc.i4 -1591469857
not <null>
ldc.i4 483187539
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_22aae9035a3c401bbf67928d6fafb97a
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
newobj System.Void qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld n6tpV3UIrSeRJwlg1ZS n6tpV3UIrSeRJwlg1ZS::QAkUbdx1hB
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN n6tpV3UIrSeRJwlg1ZS::AZFU4Kyo2e(System.Object,System.Byte[],n6tpV3UIrSeRJwlg1ZS)
ldsfld yLvwvDUJjOS9nwO8Ji0 yLvwvDUJjOS9nwO8Ji0::ObvUnY0js7
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN yLvwvDUJjOS9nwO8Ji0::AZFU4Kyo2e(System.Object,yLvwvDUJjOS9nwO8Ji0)
ldsfld cWJ7ZEUd07RRoKNPBCb cWJ7ZEUd07RRoKNPBCb::KfyUfdHBgU
call System.Void cWJ7ZEUd07RRoKNPBCb::AZFU4Kyo2e(System.Object,cWJ7ZEUd07RRoKNPBCb)
ldc.i4 7
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_cec4227e77f34697ab9d919d8a6a8f31
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_7ebac290e6164e87a1b309a45a9d2ed9
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 4
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_73c5c0082e0d4d469c74f33a52bee560
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld AJa6mCU02ae9yr7SMtZ AJa6mCU02ae9yr7SMtZ::jfYUNmjMjN
call System.Void AJa6mCU02ae9yr7SMtZ::AZFU4Kyo2e(AJa6mCU02ae9yr7SMtZ)
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_47a6a7f117f9466798cf6e485cba9b0a
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
Module Name
Psmyy.exe
Full Name
Psmyy.exe
EntryPoint
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Scope Name
Psmyy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Psmyy
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void pFj4kcSTwUSaUApXAg.nY9x8TUprGGv3fOCpq::TX8I3MlRO()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld PApmOHUE1HPx95LnIDQ PApmOHUE1HPx95LnIDQ::VJCU8hiaUk
call System.Byte[] PApmOHUE1HPx95LnIDQ::AZFU4Kyo2e(PApmOHUE1HPx95LnIDQ)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_db100eb2e3e3446f82b3f9a69bd317ed
brtrue IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 144016953
ldc.i4 144016953
ldc.i4 790711922
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_9a680fbc0ede43b7800312d27c4361f8
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
ldc.i4 -1591469857
not <null>
ldc.i4 483187539
xor <null>
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_22aae9035a3c401bbf67928d6fafb97a
xor <null>
ldsfld zOPh3UUUEmrEwEHachG zOPh3UUUEmrEwEHachG::TIQUSvNorX
call System.String zOPh3UUUEmrEwEHachG::AZFU4Kyo2e(System.Int32,zOPh3UUUEmrEwEHachG)
newobj System.Void qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld n6tpV3UIrSeRJwlg1ZS n6tpV3UIrSeRJwlg1ZS::QAkUbdx1hB
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN n6tpV3UIrSeRJwlg1ZS::AZFU4Kyo2e(System.Object,System.Byte[],n6tpV3UIrSeRJwlg1ZS)
ldsfld yLvwvDUJjOS9nwO8Ji0 yLvwvDUJjOS9nwO8Ji0::ObvUnY0js7
call qN0L7fr3FXkxq4ta3pd.OD9eHtr46nm6Dlu25XN yLvwvDUJjOS9nwO8Ji0::AZFU4Kyo2e(System.Object,yLvwvDUJjOS9nwO8Ji0)
ldsfld cWJ7ZEUd07RRoKNPBCb cWJ7ZEUd07RRoKNPBCb::KfyUfdHBgU
call System.Void cWJ7ZEUd07RRoKNPBCb::AZFU4Kyo2e(System.Object,cWJ7ZEUd07RRoKNPBCb)
ldc.i4 7
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_cec4227e77f34697ab9d919d8a6a8f31
brfalse IL_0077: switch(IL_011C,IL_0097)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_011C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_7ebac290e6164e87a1b309a45a9d2ed9
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 4
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_73c5c0082e0d4d469c74f33a52bee560
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
ldsfld AJa6mCU02ae9yr7SMtZ AJa6mCU02ae9yr7SMtZ::jfYUNmjMjN
call System.Void AJa6mCU02ae9yr7SMtZ::AZFU4Kyo2e(AJa6mCU02ae9yr7SMtZ)
ldc.i4 1
ldsfld <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4} <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_62be7eacb6cd493faef0deb6c1a7eed5
ldfld System.Int32 <Module>{39456dd4-efe8-4d2a-8bcf-ba3b1adccdb4}::m_47a6a7f117f9466798cf6e485cba9b0a
brfalse IL_0014: switch(IL_0038,IL_0039,IL_0193)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0039,IL_0193)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙