Malicious
Malicious

8939944d8166c83426cdfe1abea64520

PE Executable
MD5: 8939944d8166c83426cdfe1abea64520
Size: 826.88 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
826.88 KB · 826,880 B
Hashes
MD5 8939944d8166c83426cdfe1abea64520 Sha1 eea496d870cfb52b959313edd3278e0682aa9ef0 Sha256 9fb63f6266dfbc7b3cb527d19134c13f51c2c3080c5242756296f2a7a090a200 Sha384 7492ecebb3ca58e394adf5ee8ee963a8760d6cbe65b0cdaa12308239fc2c122e246395558f7c6910ee0f3d8e4bf243d5 Sha512 a34f45f02f486817ccc744152521da5fa4e9cb8ec18835bcc63616ad6e8385b9a0ed6d2ee58f81562dafa84fe3ac91fb4d097a15b5c7e78e1b60582131a2cb52 SSDeep 12288:PNUplz80dKBPWk87r6Cb+Uwmr+5uMiPYd03tPdMLf:PNr+cIUk+Q/EgdMLf TLSH 6605AE6A76924E21D24A5372C1C7890087E6964736ABFB0F31C803D719437EEDE4A7DB
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE8939944d8166c83426cdfe1abea64520
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINhxg7PvImJH6loVwdGg.EU6yAB5fNy1AJc84r8
BINXZ7rx8xY5G20u8R06J.DMmfHgX0KdBfuG0WkM
BINE8uk2k2Ibh4kiKWvR9.i8DLPudbYHqK2IAPTM
BINpNEnyUgh0PGvKRmFlK.BE9ulQAujjZZXQrirg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Zjvwo.exe
Full Name
Zjvwo.exe
EntryPoint
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Scope Name
Zjvwo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zjvwo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0193: ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
ret <null>
nop <null>
ldsfld eVdayF4II3ShafPW2yc eVdayF4II3ShafPW2yc::pgX45DeUR9
call System.Byte[] eVdayF4II3ShafPW2yc::eZo43QqKwQ(eVdayF4II3ShafPW2yc)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_527fd2d7f9754af3885797dc7d771cd4
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -1615038544
ldc.i4 -1615038544
ldc.i4 -2110506927
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_5b1df0dcff8d450d8af6c813615308f5
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
ldc.i4 -1130004946
not <null>
ldc.i4 696142871
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9030efbd47304d6faf5ad8b48cf91968
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
newobj System.Void xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nQWeIB4PcmW66XSSgqw nQWeIB4PcmW66XSSgqw::w8S4h7tiSY
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg nQWeIB4PcmW66XSSgqw::eZo43QqKwQ(System.Object,System.Byte[],nQWeIB4PcmW66XSSgqw)
ldsfld vAXhqh4Jn0dDwAXSjv7 vAXhqh4Jn0dDwAXSjv7::yHF4O81m9b
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg vAXhqh4Jn0dDwAXSjv7::eZo43QqKwQ(System.Object,vAXhqh4Jn0dDwAXSjv7)
ldsfld K5aVWu4ZDUE40fOkBuG K5aVWu4ZDUE40fOkBuG::Mm84KhPZCf
call System.Void K5aVWu4ZDUE40fOkBuG::eZo43QqKwQ(System.Object,K5aVWu4ZDUE40fOkBuG)
ldc.i4 6
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_3c0e9907aaba4d33b7762eb94ea5b18c
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_8c72cb1f5ef3458fb2109d6aea7544ef
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 0
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_719b11d083ef45cfb87d6abd8ea58e9e
brfalse IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
call System.Void dfpOZS42ENGmIu4d9m0::eZo43QqKwQ(dfpOZS42ENGmIu4d9m0)
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_2e737343ef0d4dbd853f80b38201072d
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
Module Name
Zjvwo.exe
Full Name
Zjvwo.exe
EntryPoint
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Scope Name
Zjvwo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zjvwo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0193: ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
ret <null>
nop <null>
ldsfld eVdayF4II3ShafPW2yc eVdayF4II3ShafPW2yc::pgX45DeUR9
call System.Byte[] eVdayF4II3ShafPW2yc::eZo43QqKwQ(eVdayF4II3ShafPW2yc)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_527fd2d7f9754af3885797dc7d771cd4
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -1615038544
ldc.i4 -1615038544
ldc.i4 -2110506927
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_5b1df0dcff8d450d8af6c813615308f5
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
ldc.i4 -1130004946
not <null>
ldc.i4 696142871
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9030efbd47304d6faf5ad8b48cf91968
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
newobj System.Void xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nQWeIB4PcmW66XSSgqw nQWeIB4PcmW66XSSgqw::w8S4h7tiSY
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg nQWeIB4PcmW66XSSgqw::eZo43QqKwQ(System.Object,System.Byte[],nQWeIB4PcmW66XSSgqw)
ldsfld vAXhqh4Jn0dDwAXSjv7 vAXhqh4Jn0dDwAXSjv7::yHF4O81m9b
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg vAXhqh4Jn0dDwAXSjv7::eZo43QqKwQ(System.Object,vAXhqh4Jn0dDwAXSjv7)
ldsfld K5aVWu4ZDUE40fOkBuG K5aVWu4ZDUE40fOkBuG::Mm84KhPZCf
call System.Void K5aVWu4ZDUE40fOkBuG::eZo43QqKwQ(System.Object,K5aVWu4ZDUE40fOkBuG)
ldc.i4 6
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_3c0e9907aaba4d33b7762eb94ea5b18c
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_8c72cb1f5ef3458fb2109d6aea7544ef
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 0
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_719b11d083ef45cfb87d6abd8ea58e9e
brfalse IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
call System.Void dfpOZS42ENGmIu4d9m0::eZo43QqKwQ(dfpOZS42ENGmIu4d9m0)
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_2e737343ef0d4dbd853f80b38201072d
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
1 malicious · 7 files
EXE8939944d8166c83426cdfe1abea64520
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙