Malicious
Malicious

919d26f0f845dbfa79bcbad25afd7f10

Share on LinkedIn
Print
PE Executable
MD5: 919d26f0f845dbfa79bcbad25afd7f10
Size: 436.74 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 919d26f0f845dbfa79bcbad25afd7f10
Sha1 7bfaa6511ea14a8a108879f6125b91005ae8053a
Sha256 fc9d4239c1570e3629d2ce849fb68d854b6021e1808e49816df9d797dc5090c3
Sha384 3bd47bd144b2bff9b001a6ce0a6a33f2c371ad1398e5b7d194dcfc9f8ad19859767172fe1b5004a86bfb725bac74d36d
Sha512 ff4f86d3a6fbe1c754eb879f80278112cc6111b273cbbbeb2ebba1daee4d5cf2b0a3bf389b80fb3bdf9afb73858617decb6ff6a566e394305a048f6ace99e600
SSDeep 6144:zdxyagd/PliedD/6DeVZ/8f9Eb2oNQRyc7Y0X6hm/Z43ackgd7w/:jadXYo66Z02+7gmG9kX
TLSH F694182B3A524E51C2852B73C29B850087A69A87FEA3F34F724403A95D473FED947793
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
919d26f0f845dbfa79bcbad25afd7f10
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uhXTaf4kFQ7XFmPQsa.KmdPAZKPrXvL34AwYU
6H2REkajTl5x5WyRFm.Lr2dOGGXiTwe3S5RHY
NDiSUrU9cv2dCeXQoG.sJAYEmNVUkbN4iR2Ln
ux3aV3OiuPdSJ9rPtp.XhraNhx5pMup7IDrsK
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Bmowxichq.exe
Full Name
Bmowxichq.exe
EntryPoint
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Scope Name
Bmowxichq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bmowxichq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld BWUqUIX1Q8y39BBdjhA BWUqUIX1Q8y39BBdjhA::IrHXoROBTG
call System.Byte[] BWUqUIX1Q8y39BBdjhA::ypfXcJlIBp(BWUqUIX1Q8y39BBdjhA)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_757f71c2e5ea47e4b1c5ca122bb1c664
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0112)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0112: leave IL_0038
ldc.i4 -1226860399
ldc.i4 -1358572720
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_ea2181f75be740109552e201f31b23d4
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
ldc.i4 -1665208767
ldc.i4 -1191888262
sub <null>
ldc.i4 -1360750395
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_339fe0fd723d490e9e5b8c1d3ffde43c
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
newobj System.Void BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS::.ctor(System.String,System.String)
newobj System.Void tsGqiNxUppFLt646C6E.dTF4yXxKiKeIGWbE3kV::.ctor(BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS)
ldloc.s V_3
ldsfld OvhH92XCpBmHE9FFLRZ OvhH92XCpBmHE9FFLRZ::WypXz834hY
call System.Void OvhH92XCpBmHE9FFLRZ::ypfXcJlIBp(System.Object,System.Byte[],OvhH92XCpBmHE9FFLRZ)
ldc.i4 7
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_51237a4396dd40199c2f0afb6b8ff713
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0112)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_3992c07fc4434725948b91e94cb202a4
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 3
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_e1839f846aa14c9ba34a850e5c69d813
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld GgBODYX684HLN2ruwnE GgBODYX684HLN2ruwnE::AnrXrKEA6x
call System.Void GgBODYX684HLN2ruwnE::ypfXcJlIBp(GgBODYX684HLN2ruwnE)
ldc.i4 1
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_2f85615b7918431f8e313db89186b416
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
Module Name
Bmowxichq.exe
Full Name
Bmowxichq.exe
EntryPoint
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Scope Name
Bmowxichq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Bmowxichq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kg9FMGioT45DC2yIR2.kxA3GaXTLaSeYWBpl3::jsFMVZMlG()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0038: ret
ret <null>
nop <null>
ldsfld BWUqUIX1Q8y39BBdjhA BWUqUIX1Q8y39BBdjhA::IrHXoROBTG
call System.Byte[] BWUqUIX1Q8y39BBdjhA::ypfXcJlIBp(BWUqUIX1Q8y39BBdjhA)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_757f71c2e5ea47e4b1c5ca122bb1c664
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0112)
br IL_0073: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0073: ldloc V_0
br IL_0112: leave IL_0038
ldc.i4 -1226860399
ldc.i4 -1358572720
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_ea2181f75be740109552e201f31b23d4
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
ldc.i4 -1665208767
ldc.i4 -1191888262
sub <null>
ldc.i4 -1360750395
xor <null>
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_339fe0fd723d490e9e5b8c1d3ffde43c
xor <null>
ldsfld LOoGdBXSa7aRj4m5NGn LOoGdBXSa7aRj4m5NGn::xKdXFOd4dT
call System.String LOoGdBXSa7aRj4m5NGn::ypfXcJlIBp(System.Int32,LOoGdBXSa7aRj4m5NGn)
newobj System.Void BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS::.ctor(System.String,System.String)
newobj System.Void tsGqiNxUppFLt646C6E.dTF4yXxKiKeIGWbE3kV::.ctor(BeYEIuZDE1JDU4aRLQ.TlNtroYjMGLXbDGjlS)
ldloc.s V_3
ldsfld OvhH92XCpBmHE9FFLRZ OvhH92XCpBmHE9FFLRZ::WypXz834hY
call System.Void OvhH92XCpBmHE9FFLRZ::ypfXcJlIBp(System.Object,System.Byte[],OvhH92XCpBmHE9FFLRZ)
ldc.i4 7
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_51237a4396dd40199c2f0afb6b8ff713
brfalse IL_0077: switch(IL_0097,IL_0112)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0112)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_3992c07fc4434725948b91e94cb202a4
brfalse IL_0149: switch(IL_0165)
pop <null>
ldc.i4 3
br IL_0149: switch(IL_0165)
br IL_0145: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0145: ldloc V_2
br IL_0165: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_e1839f846aa14c9ba34a850e5c69d813
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
ldsfld GgBODYX684HLN2ruwnE GgBODYX684HLN2ruwnE::AnrXrKEA6x
call System.Void GgBODYX684HLN2ruwnE::ypfXcJlIBp(GgBODYX684HLN2ruwnE)
ldc.i4 1
ldsfld <Module>{8714dd99-f1b4-4021-8625-b19173b022a5} <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_64f5f18da176472bbeb7f9a17dbba830
ldfld System.Int32 <Module>{8714dd99-f1b4-4021-8625-b19173b022a5}::m_2f85615b7918431f8e313db89186b416
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0189)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0039,IL_0189)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙