Malicious
Malicious

8f82374cae854dcc3df5a9a6e849de1c

PE Executable
MD5: 8f82374cae854dcc3df5a9a6e849de1c
Size: 424.96 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8f82374cae854dcc3df5a9a6e849de1c
Sha1 a3acb9e0ef8bdd2fb0225613864bd08cb44df87d
Sha256 9a77e80a5ad7cf9df388338fc4988ac2b05c6f31249bdb356cc86f66be232022
Sha384 9cc6db907a97b665b3cadf2ce974a9841f1c77e23c5bc8c9c55c8c1ff54093382632fd8573485246f9270711ec940727
Sha512 347ed1bd2c85305fc77f6771801bb6c5fd953343af8b29d143ac8885b8a1cfb8c082492d1fda5abc3a2e43aec8076336253dbaa42e6b1fe6a69923b8d646d844
SSDeep 6144:wjCjQ/Qv5EAtsoEACnecXMlg+a6RWYR0yBJZ22ONn4GFRua:w2jlvedorCnecmgKR9BBJZxOlFRua
TLSH 1F943B7A32928F21C14A6373C1C3590087E69A4776EBEB0B718503D62D477FEDE0A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8f82374cae854dcc3df5a9a6e849de1c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
KDwy6OmOTbpDMXvwst.1cABaLsFpZv6fV8MPI
lcJ3Fk0xtWoILCtr0L.lfgUHr4GxFv7hWGlLi
HfCvp8ZtBtq09cQbjE.TqtfBKOdRTMpVSxTSn
LJwSbkSW9fVxgbi81u.ZvpwrjLhqIcP2296uu
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Unrmnrea.exe
Full Name
Unrmnrea.exe
EntryPoint
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Scope Name
Unrmnrea.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Unrmnrea
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0199: ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
nop <null>
ldsfld KpvygdP0fcAE41YJVgl KpvygdP0fcAE41YJVgl::w95P45uF8M
call System.Byte[] KpvygdP0fcAE41YJVgl::AtnPVE4tvO(KpvygdP0fcAE41YJVgl)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_ec63301c2ab74d0eaca88e5c411862fd
brfalse IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0121,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_0121: leave IL_0198
ldc.i4 -1657967103
ldc.i4 1139965536
add <null>
ldc.i4 -1428804338
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
ldc.i4 1851895203
not <null>
ldc.i4 -252302526
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_89153082febc409daa604724558c4c21
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
newobj System.Void d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld oSeyQ6PCxoD0eTLvcA6 oSeyQ6PCxoD0eTLvcA6::vCYPWqDCg0
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 oSeyQ6PCxoD0eTLvcA6::AtnPVE4tvO(System.Object,System.Byte[],oSeyQ6PCxoD0eTLvcA6)
ldsfld RopIx0Pqt5nk8GIxQWQ RopIx0Pqt5nk8GIxQWQ::tJBPUiu8Z6
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 RopIx0Pqt5nk8GIxQWQ::AtnPVE4tvO(System.Object,RopIx0Pqt5nk8GIxQWQ)
ldsfld RS7HWCPv0m3Nc58OOwQ RS7HWCPv0m3Nc58OOwQ::A1ZP17DhJl
call System.Void RS7HWCPv0m3Nc58OOwQ::AtnPVE4tvO(System.Object,RS7HWCPv0m3Nc58OOwQ)
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_76614239c553488798b844ca6ea6b319
brtrue IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0121,IL_0096)
leave IL_0198: ret
pop <null>
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
brfalse IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0154: ldloc V_3
br IL_0174: leave IL_0198
leave IL_0198: ret
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_d8d9cdbf7a5b486285294bf0f52e49bf
brfalse IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
ret <null>
ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
call System.Void xkIsQIPm5IdHyFMpq1b::AtnPVE4tvO(xkIsQIPm5IdHyFMpq1b)
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_61f07a90547f4e908f33699f7f1e942f
brtrue IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
Module Name
Unrmnrea.exe
Full Name
Unrmnrea.exe
EntryPoint
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Scope Name
Unrmnrea.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Unrmnrea
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0199: ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
nop <null>
ldsfld KpvygdP0fcAE41YJVgl KpvygdP0fcAE41YJVgl::w95P45uF8M
call System.Byte[] KpvygdP0fcAE41YJVgl::AtnPVE4tvO(KpvygdP0fcAE41YJVgl)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_ec63301c2ab74d0eaca88e5c411862fd
brfalse IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0121,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_0121: leave IL_0198
ldc.i4 -1657967103
ldc.i4 1139965536
add <null>
ldc.i4 -1428804338
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
ldc.i4 1851895203
not <null>
ldc.i4 -252302526
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_89153082febc409daa604724558c4c21
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
newobj System.Void d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld oSeyQ6PCxoD0eTLvcA6 oSeyQ6PCxoD0eTLvcA6::vCYPWqDCg0
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 oSeyQ6PCxoD0eTLvcA6::AtnPVE4tvO(System.Object,System.Byte[],oSeyQ6PCxoD0eTLvcA6)
ldsfld RopIx0Pqt5nk8GIxQWQ RopIx0Pqt5nk8GIxQWQ::tJBPUiu8Z6
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 RopIx0Pqt5nk8GIxQWQ::AtnPVE4tvO(System.Object,RopIx0Pqt5nk8GIxQWQ)
ldsfld RS7HWCPv0m3Nc58OOwQ RS7HWCPv0m3Nc58OOwQ::A1ZP17DhJl
call System.Void RS7HWCPv0m3Nc58OOwQ::AtnPVE4tvO(System.Object,RS7HWCPv0m3Nc58OOwQ)
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_76614239c553488798b844ca6ea6b319
brtrue IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0121,IL_0096)
leave IL_0198: ret
pop <null>
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
brfalse IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0154: ldloc V_3
br IL_0174: leave IL_0198
leave IL_0198: ret
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_d8d9cdbf7a5b486285294bf0f52e49bf
brfalse IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
ret <null>
ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
call System.Void xkIsQIPm5IdHyFMpq1b::AtnPVE4tvO(xkIsQIPm5IdHyFMpq1b)
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_61f07a90547f4e908f33699f7f1e942f
brtrue IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
8f82374cae854dcc3df5a9a6e849de1c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
KDwy6OmOTbpDMXvwst.1cABaLsFpZv6fV8MPI
lcJ3Fk0xtWoILCtr0L.lfgUHr4GxFv7hWGlLi
HfCvp8ZtBtq09cQbjE.TqtfBKOdRTMpVSxTSn
LJwSbkSW9fVxgbi81u.ZvpwrjLhqIcP2296uu
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙