Deep Malware Analysis of 94d844fa5163100fe679fc9089e71258 | md5: 94d844fa5163100fe679fc9089e71258 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.56

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	94d844fa5163100fe679fc9089e71258
Sha1	a0a7067d47689d63110fe2b8458c88eb6af6e489
Sha256	79965c365c3cc4422bfbb808d7e36d50f631d68552601d85ebeabb8c887320fe
Sha384	b727052cf7e5596b4d77e7bff4879f4198b37eb0f7f47f010d70465278ff84d5e42c3e6bf0590fb7e322cddfa82957a9
Sha512	43651c0a7bda8caa35835bcd2628240383f49a061e1005160863bc7fe4b15e74357b1a6955fa51c89cf4a622ac2186dbd690dc6d8dfeee009f945bff4d6d5dbf
SSDeep	24576:Cw6d8ggV2UOewZtsPrulJZiO3F7c4hFni0YTDq5iF:Cbqg02UONsPkZiM3niNTUi
TLSH	7A05BD14661ADD22C0E906B6C8D1D1FF02B16D87E452F28B9AD97DAF7A31390F7802C7

PeID

HQR data fileMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	WRKS.exe
Full Name	WRKS.exe
EntryPoint	System.Void Bq.Ht::fn()
Scope Name	WRKS.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	WRKS
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	432
Main Method	System.Void Bq.Ht::fn()
Main IL Instruction Count	43
Main IL	br IL_0036: nop ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0027: newobj System.Void toe.NoY::.ctor() nop <null> newobj System.Void pTb.LTP::.ctor() stsfld pTb.LTP Bq.Ht::Du br IL_0077: newobj System.Void nav.xaM::.ctor() newobj System.Void toe.NoY::.ctor() stsfld toe.NoY Bq.Ht::x1 br IL_004B: newobj System.Void N4G.M4S::.ctor() nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_005A: nop call System.Void Ay3.Tyc::GLl() br IL_00AF: nop newobj System.Void N4G.M4S::.ctor() stsfld N4G.M4S Bq.Ht::Ql br IL_0068: ldsfld N4G.M4S Bq.Ht::Ql nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0041: call System.Void Ay3.Tyc::GLl() nop <null> ret <null> ldsfld N4G.M4S Bq.Ht::Ql call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0066: nop newobj System.Void nav.xaM::.ctor() stsfld nav.xaM Bq.Ht::qj br IL_0086: newobj System.Void yaR.oaD::.ctor() newobj System.Void yaR.oaD::.ctor() stsfld yaR.oaD Bq.Ht::H9 ldc.i4 0 ldsfld <Module>{967afa9e-3b33-4d38-a586-8f522c158fa1} <Module>{967afa9e-3b33-4d38-a586-8f522c158fa1}::m_4dedc870040943258f298f985c56bafc ldfld System.Int32 <Module>{967afa9e-3b33-4d38-a586-8f522c158fa1}::m_f1131c8dbe314b84a069d3670d2e5d4f brtrue IL_0009: switch(IL_0027) pop <null> ldc.i4 0 br IL_0009: switch(IL_0027) nop <null> call System.Void Bq.Ht::Bs() br IL_0017: nop