Malicious
Malicious

919d26f0f845dbfa79bcbad25afd7f10

PE Executable
MD5: 919d26f0f845dbfa79bcbad25afd7f10
Size: 436.74 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 919d26f0f845dbfa79bcbad25afd7f10
Sha1 7bfaa6511ea14a8a108879f6125b91005ae8053a
Sha256 fc9d4239c1570e3629d2ce849fb68d854b6021e1808e49816df9d797dc5090c3
Sha384 3bd47bd144b2bff9b001a6ce0a6a33f2c371ad1398e5b7d194dcfc9f8ad19859767172fe1b5004a86bfb725bac74d36d
Sha512 ff4f86d3a6fbe1c754eb879f80278112cc6111b273cbbbeb2ebba1daee4d5cf2b0a3bf389b80fb3bdf9afb73858617decb6ff6a566e394305a048f6ace99e600
SSDeep 6144:zdxyagd/PliedD/6DeVZ/8f9Eb2oNQRyc7Y0X6hm/Z43ackgd7w/:jadXYo66Z02+7gmG9kX
TLSH F694182B3A524E51C2852B73C29B850087A69A87FEA3F34F724403A95D473FED947793
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
919d26f0f845dbfa79bcbad25afd7f10
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uhXTaf4kFQ7XFmPQsa.KmdPAZKPrXvL34AwYU
6H2REkajTl5x5WyRFm.Lr2dOGGXiTwe3S5RHY
NDiSUrU9cv2dCeXQoG.sJAYEmNVUkbN4iR2Ln
ux3aV3OiuPdSJ9rPtp.XhraNhx5pMup7IDrsK
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Bmowxichq.exe
Full Name
Bmowxichq.exe
EntryPoint
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Scope Name
Bmowxichq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bmowxichq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld BWUqUIX1Q8y39BBdjhA BWUqUIX1Q8y39BBdjhA::IrHXoROBTG
call System.Byte[] BWUqUIX1Q8y39BBdjhA::ypfXcJlIBp(BWUqUIX1Q8y39BBdjhA)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_757f71c2e5ea47e4b1c5ca122bb1c664
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0112)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0112: leave IL_0038
ldc.i4 -1226860399
ldc.i4 -1358572720
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_ea2181f75be740109552e201f31b23d4
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
ldc.i4 -1665208767
ldc.i4 -1191888262
sub <null>
ldc.i4 -1360750395
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_339fe0fd723d490e9e5b8c1d3ffde43c
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
newobj System.Void BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS::.ctor(System.String,System.String)
newobj System.Void tsGqiNxUppFLt646C6E.dTF4yXxKiKeIGWbE3kV::.ctor(BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS)
ldloc.s V_3
ldsfld OvhH92XCpBmHE9FFLRZ OvhH92XCpBmHE9FFLRZ::WypXz834hY
call System.Void OvhH92XCpBmHE9FFLRZ::ypfXcJlIBp(System.Object,System.Byte[],OvhH92XCpBmHE9FFLRZ)
ldc.i4 7
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_51237a4396dd40199c2f0afb6b8ff713
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0112)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_3992c07fc4434725948b91e94cb202a4
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 3
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_e1839f846aa14c9ba34a850e5c69d813
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld GgBODYX684HLN2ruwnE GgBODYX684HLN2ruwnE::AnrXrKEA6x
call System.Void GgBODYX684HLN2ruwnE::ypfXcJlIBp(GgBODYX684HLN2ruwnE)
ldc.i4 1
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_2f85615b7918431f8e313db89186b416
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
Module Name
Bmowxichq.exe
Full Name
Bmowxichq.exe
EntryPoint
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Scope Name
Bmowxichq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bmowxichq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld BWUqUIX1Q8y39BBdjhA BWUqUIX1Q8y39BBdjhA::IrHXoROBTG
call System.Byte[] BWUqUIX1Q8y39BBdjhA::ypfXcJlIBp(BWUqUIX1Q8y39BBdjhA)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_757f71c2e5ea47e4b1c5ca122bb1c664
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0112)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0112: leave IL_0038
ldc.i4 -1226860399
ldc.i4 -1358572720
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_ea2181f75be740109552e201f31b23d4
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
ldc.i4 -1665208767
ldc.i4 -1191888262
sub <null>
ldc.i4 -1360750395
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_339fe0fd723d490e9e5b8c1d3ffde43c
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
newobj System.Void BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS::.ctor(System.String,System.String)
newobj System.Void tsGqiNxUppFLt646C6E.dTF4yXxKiKeIGWbE3kV::.ctor(BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS)
ldloc.s V_3
ldsfld OvhH92XCpBmHE9FFLRZ OvhH92XCpBmHE9FFLRZ::WypXz834hY
call System.Void OvhH92XCpBmHE9FFLRZ::ypfXcJlIBp(System.Object,System.Byte[],OvhH92XCpBmHE9FFLRZ)
ldc.i4 7
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_51237a4396dd40199c2f0afb6b8ff713
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0112)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_3992c07fc4434725948b91e94cb202a4
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 3
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_e1839f846aa14c9ba34a850e5c69d813
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld GgBODYX684HLN2ruwnE GgBODYX684HLN2ruwnE::AnrXrKEA6x
call System.Void GgBODYX684HLN2ruwnE::ypfXcJlIBp(GgBODYX684HLN2ruwnE)
ldc.i4 1
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_2f85615b7918431f8e313db89186b416
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
919d26f0f845dbfa79bcbad25afd7f10
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uhXTaf4kFQ7XFmPQsa.KmdPAZKPrXvL34AwYU
6H2REkajTl5x5WyRFm.Lr2dOGGXiTwe3S5RHY
NDiSUrU9cv2dCeXQoG.sJAYEmNVUkbN4iR2Ln
ux3aV3OiuPdSJ9rPtp.XhraNhx5pMup7IDrsK
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙