Malicious
Malicious

8f82374cae854dcc3df5a9a6e849de1c

Share on LinkedIn
Print
PE Executable
MD5: 8f82374cae854dcc3df5a9a6e849de1c
Size: 424.96 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8f82374cae854dcc3df5a9a6e849de1c
Sha1 a3acb9e0ef8bdd2fb0225613864bd08cb44df87d
Sha256 9a77e80a5ad7cf9df388338fc4988ac2b05c6f31249bdb356cc86f66be232022
Sha384 9cc6db907a97b665b3cadf2ce974a9841f1c77e23c5bc8c9c55c8c1ff54093382632fd8573485246f9270711ec940727
Sha512 347ed1bd2c85305fc77f6771801bb6c5fd953343af8b29d143ac8885b8a1cfb8c082492d1fda5abc3a2e43aec8076336253dbaa42e6b1fe6a69923b8d646d844
SSDeep 6144:wjCjQ/Qv5EAtsoEACnecXMlg+a6RWYR0yBJZ22ONn4GFRua:w2jlvedorCnecmgKR9BBJZxOlFRua
TLSH 1F943B7A32928F21C14A6373C1C3590087E69A4776EBEB0B718503D62D477FEDE0A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8f82374cae854dcc3df5a9a6e849de1c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
KDwy6OmOTbpDMXvwst.1cABaLsFpZv6fV8MPI
lcJ3Fk0xtWoILCtr0L.lfgUHr4GxFv7hWGlLi
HfCvp8ZtBtq09cQbjE.TqtfBKOdRTMpVSxTSn
LJwSbkSW9fVxgbi81u.ZvpwrjLhqIcP2296uu
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Unrmnrea.exe
Full Name
Unrmnrea.exe
EntryPoint
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Scope Name
Unrmnrea.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Unrmnrea
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0199: ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
nop <null>
ldsfld KpvygdP0fcAE41YJVgl KpvygdP0fcAE41YJVgl::w95P45uF8M
call System.Byte[] KpvygdP0fcAE41YJVgl::AtnPVE4tvO(KpvygdP0fcAE41YJVgl)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_ec63301c2ab74d0eaca88e5c411862fd
brfalse IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0121,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_0121: leave IL_0198
ldc.i4 -1657967103
ldc.i4 1139965536
add <null>
ldc.i4 -1428804338
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
ldc.i4 1851895203
not <null>
ldc.i4 -252302526
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_89153082febc409daa604724558c4c21
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
newobj System.Void d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld oSeyQ6PCxoD0eTLvcA6 oSeyQ6PCxoD0eTLvcA6::vCYPWqDCg0
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 oSeyQ6PCxoD0eTLvcA6::AtnPVE4tvO(System.Object,System.Byte[],oSeyQ6PCxoD0eTLvcA6)
ldsfld RopIx0Pqt5nk8GIxQWQ RopIx0Pqt5nk8GIxQWQ::tJBPUiu8Z6
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 RopIx0Pqt5nk8GIxQWQ::AtnPVE4tvO(System.Object,RopIx0Pqt5nk8GIxQWQ)
ldsfld RS7HWCPv0m3Nc58OOwQ RS7HWCPv0m3Nc58OOwQ::A1ZP17DhJl
call System.Void RS7HWCPv0m3Nc58OOwQ::AtnPVE4tvO(System.Object,RS7HWCPv0m3Nc58OOwQ)
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_76614239c553488798b844ca6ea6b319
brtrue IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0121,IL_0096)
leave IL_0198: ret
pop <null>
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
brfalse IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0154: ldloc V_3
br IL_0174: leave IL_0198
leave IL_0198: ret
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_d8d9cdbf7a5b486285294bf0f52e49bf
brfalse IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
ret <null>
ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
call System.Void xkIsQIPm5IdHyFMpq1b::AtnPVE4tvO(xkIsQIPm5IdHyFMpq1b)
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_61f07a90547f4e908f33699f7f1e942f
brtrue IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
Module Name
Unrmnrea.exe
Full Name
Unrmnrea.exe
EntryPoint
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Scope Name
Unrmnrea.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Unrmnrea
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void O9cBJBKda4p5Z4krUn.woVdkQPJ7uYGMp6mFv::aoCC35TAu()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0199: ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
nop <null>
ldsfld KpvygdP0fcAE41YJVgl KpvygdP0fcAE41YJVgl::w95P45uF8M
call System.Byte[] KpvygdP0fcAE41YJVgl::AtnPVE4tvO(KpvygdP0fcAE41YJVgl)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_ec63301c2ab74d0eaca88e5c411862fd
brfalse IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0121,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_0121: leave IL_0198
ldc.i4 -1657967103
ldc.i4 1139965536
add <null>
ldc.i4 -1428804338
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
ldc.i4 1851895203
not <null>
ldc.i4 -252302526
xor <null>
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_89153082febc409daa604724558c4c21
xor <null>
ldsfld CIgERVPPySKpkOwT3dG CIgERVPPySKpkOwT3dG::U24PKPECq6
call System.String CIgERVPPySKpkOwT3dG::AtnPVE4tvO(System.Int32,CIgERVPPySKpkOwT3dG)
newobj System.Void d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld oSeyQ6PCxoD0eTLvcA6 oSeyQ6PCxoD0eTLvcA6::vCYPWqDCg0
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 oSeyQ6PCxoD0eTLvcA6::AtnPVE4tvO(System.Object,System.Byte[],oSeyQ6PCxoD0eTLvcA6)
ldsfld RopIx0Pqt5nk8GIxQWQ RopIx0Pqt5nk8GIxQWQ::tJBPUiu8Z6
call d42fKSS3bJZKJ4YGPvy.IBnTESSVrNTtQ1tFpm0 RopIx0Pqt5nk8GIxQWQ::AtnPVE4tvO(System.Object,RopIx0Pqt5nk8GIxQWQ)
ldsfld RS7HWCPv0m3Nc58OOwQ RS7HWCPv0m3Nc58OOwQ::A1ZP17DhJl
call System.Void RS7HWCPv0m3Nc58OOwQ::AtnPVE4tvO(System.Object,RS7HWCPv0m3Nc58OOwQ)
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_76614239c553488798b844ca6ea6b319
brtrue IL_0076: switch(IL_0121,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0121,IL_0096)
leave IL_0198: ret
pop <null>
ldc.i4 0
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_e44338443bc84c84abc24f32189a3ef6
brfalse IL_0158: switch(IL_0174)
pop <null>
ldc.i4 0
br IL_0158: switch(IL_0174)
br IL_0154: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0154: ldloc V_3
br IL_0174: leave IL_0198
leave IL_0198: ret
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_d8d9cdbf7a5b486285294bf0f52e49bf
brfalse IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
ret <null>
ldsfld xkIsQIPm5IdHyFMpq1b xkIsQIPm5IdHyFMpq1b::C9JPsw22FM
call System.Void xkIsQIPm5IdHyFMpq1b::AtnPVE4tvO(xkIsQIPm5IdHyFMpq1b)
ldc.i4 2
ldsfld <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0} <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_3e538a5cfa894031ab65d9dd9242fb85
ldfld System.Int32 <Module>{01577b10-aa68-4801-8eb2-99ec400a10a0}::m_61f07a90547f4e908f33699f7f1e942f
brtrue IL_0014: switch(IL_0038,IL_0199,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0199,IL_0198)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙