Malicious
Malicious

8939944d8166c83426cdfe1abea64520

PE Executable
MD5: 8939944d8166c83426cdfe1abea64520
Size: 826.88 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8939944d8166c83426cdfe1abea64520
Sha1 eea496d870cfb52b959313edd3278e0682aa9ef0
Sha256 9fb63f6266dfbc7b3cb527d19134c13f51c2c3080c5242756296f2a7a090a200
Sha384 7492ecebb3ca58e394adf5ee8ee963a8760d6cbe65b0cdaa12308239fc2c122e246395558f7c6910ee0f3d8e4bf243d5
Sha512 a34f45f02f486817ccc744152521da5fa4e9cb8ec18835bcc63616ad6e8385b9a0ed6d2ee58f81562dafa84fe3ac91fb4d097a15b5c7e78e1b60582131a2cb52
SSDeep 12288:PNUplz80dKBPWk87r6Cb+Uwmr+5uMiPYd03tPdMLf:PNr+cIUk+Q/EgdMLf
TLSH 6605AE6A76924E21D24A5372C1C7890087E6964736ABFB0F31C803D719437EEDE4A7DB
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8939944d8166c83426cdfe1abea64520
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hxg7PvImJH6loVwdGg.EU6yAB5fNy1AJc84r8
XZ7rx8xY5G20u8R06J.DMmfHgX0KdBfuG0WkM
E8uk2k2Ibh4kiKWvR9.i8DLPudbYHqK2IAPTM
pNEnyUgh0PGvKRmFlK.BE9ulQAujjZZXQrirg
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Zjvwo.exe
Full Name
Zjvwo.exe
EntryPoint
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Scope Name
Zjvwo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zjvwo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0193: ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
ret <null>
nop <null>
ldsfld eVdayF4II3ShafPW2yc eVdayF4II3ShafPW2yc::pgX45DeUR9
call System.Byte[] eVdayF4II3ShafPW2yc::eZo43QqKwQ(eVdayF4II3ShafPW2yc)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_527fd2d7f9754af3885797dc7d771cd4
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -1615038544
ldc.i4 -1615038544
ldc.i4 -2110506927
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_5b1df0dcff8d450d8af6c813615308f5
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
ldc.i4 -1130004946
not <null>
ldc.i4 696142871
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9030efbd47304d6faf5ad8b48cf91968
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
newobj System.Void xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nQWeIB4PcmW66XSSgqw nQWeIB4PcmW66XSSgqw::w8S4h7tiSY
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg nQWeIB4PcmW66XSSgqw::eZo43QqKwQ(System.Object,System.Byte[],nQWeIB4PcmW66XSSgqw)
ldsfld vAXhqh4Jn0dDwAXSjv7 vAXhqh4Jn0dDwAXSjv7::yHF4O81m9b
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg vAXhqh4Jn0dDwAXSjv7::eZo43QqKwQ(System.Object,vAXhqh4Jn0dDwAXSjv7)
ldsfld K5aVWu4ZDUE40fOkBuG K5aVWu4ZDUE40fOkBuG::Mm84KhPZCf
call System.Void K5aVWu4ZDUE40fOkBuG::eZo43QqKwQ(System.Object,K5aVWu4ZDUE40fOkBuG)
ldc.i4 6
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_3c0e9907aaba4d33b7762eb94ea5b18c
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_8c72cb1f5ef3458fb2109d6aea7544ef
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 0
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_719b11d083ef45cfb87d6abd8ea58e9e
brfalse IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
call System.Void dfpOZS42ENGmIu4d9m0::eZo43QqKwQ(dfpOZS42ENGmIu4d9m0)
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_2e737343ef0d4dbd853f80b38201072d
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
Module Name
Zjvwo.exe
Full Name
Zjvwo.exe
EntryPoint
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Scope Name
Zjvwo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zjvwo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void oGELu9pRiCvv2x4KqN.dxPELd4pKCqbLfVMDU::P5qPsAO2u()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0193: ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
ret <null>
nop <null>
ldsfld eVdayF4II3ShafPW2yc eVdayF4II3ShafPW2yc::pgX45DeUR9
call System.Byte[] eVdayF4II3ShafPW2yc::eZo43QqKwQ(eVdayF4II3ShafPW2yc)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_527fd2d7f9754af3885797dc7d771cd4
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_0097,IL_011C)
br IL_0073: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0073: ldloc V_3
br IL_0097: ldc.i4 -1615038544
ldc.i4 -1615038544
ldc.i4 -2110506927
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_5b1df0dcff8d450d8af6c813615308f5
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
ldc.i4 -1130004946
not <null>
ldc.i4 696142871
xor <null>
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9030efbd47304d6faf5ad8b48cf91968
xor <null>
ldsfld EN42Lp44VP9bh3QBcsR EN42Lp44VP9bh3QBcsR::f0g4pcibCW
call System.String EN42Lp44VP9bh3QBcsR::eZo43QqKwQ(System.Int32,EN42Lp44VP9bh3QBcsR)
newobj System.Void xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld nQWeIB4PcmW66XSSgqw nQWeIB4PcmW66XSSgqw::w8S4h7tiSY
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg nQWeIB4PcmW66XSSgqw::eZo43QqKwQ(System.Object,System.Byte[],nQWeIB4PcmW66XSSgqw)
ldsfld vAXhqh4Jn0dDwAXSjv7 vAXhqh4Jn0dDwAXSjv7::yHF4O81m9b
call xy9fIrgVqxFW5rwofd8.RqqOZqg3KS2OnLvPOcg vAXhqh4Jn0dDwAXSjv7::eZo43QqKwQ(System.Object,vAXhqh4Jn0dDwAXSjv7)
ldsfld K5aVWu4ZDUE40fOkBuG K5aVWu4ZDUE40fOkBuG::Mm84KhPZCf
call System.Void K5aVWu4ZDUE40fOkBuG::eZo43QqKwQ(System.Object,K5aVWu4ZDUE40fOkBuG)
ldc.i4 6
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_3c0e9907aaba4d33b7762eb94ea5b18c
brfalse IL_0077: switch(IL_0097,IL_011C)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_011C)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_8c72cb1f5ef3458fb2109d6aea7544ef
brtrue IL_0153: switch(IL_016F)
pop <null>
ldc.i4 0
br IL_0153: switch(IL_016F)
br IL_014F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014F: ldloc V_2
br IL_016F: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_719b11d083ef45cfb87d6abd8ea58e9e
brfalse IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
ldsfld dfpOZS42ENGmIu4d9m0 dfpOZS42ENGmIu4d9m0::caP4duAjA3
call System.Void dfpOZS42ENGmIu4d9m0::eZo43QqKwQ(dfpOZS42ENGmIu4d9m0)
ldc.i4 0
ldsfld <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989} <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_9106018f2634459586a4b83f2d40d975
ldfld System.Int32 <Module>{5dbb1cb8-3567-4fc0-b253-12871ca13989}::m_2e737343ef0d4dbd853f80b38201072d
brtrue IL_0014: switch(IL_0039,IL_0193,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0039,IL_0193,IL_0038)
8939944d8166c83426cdfe1abea64520
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hxg7PvImJH6loVwdGg.EU6yAB5fNy1AJc84r8
XZ7rx8xY5G20u8R06J.DMmfHgX0KdBfuG0WkM
E8uk2k2Ibh4kiKWvR9.i8DLPudbYHqK2IAPTM
pNEnyUgh0PGvKRmFlK.BE9ulQAujjZZXQrirg
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙