Malicious
Malicious

98ed51e4a5c819bf8a7f2979c52b16ad

PE Executable
MD5: 98ed51e4a5c819bf8a7f2979c52b16ad
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 98ed51e4a5c819bf8a7f2979c52b16ad
Sha1 80712e817812528ef2ad04959714e21f9f0ff1ff
Sha256 d2338a127bed46401ea37a76e83166276b4f73cc1c171594b6383001a3e0cb4e
Sha384 bef39bc3218d8aad6b021bcf8b1d20fbf73d6734e212301d58321511e95ca266f4b778cda58710baf7cfe9bca3b31b72
Sha512 d754f195e4734c9e579248c73fc918e9a07faa9d5b4f989c203e8e40231260f35d6c7e4f72da3a3be86a28e4c1ecc48b1a94d47f03355a13b9ad031404e969aa
SSDeep 12288:Oqf9FO4jYkmD2B4T25t7DKGGgPUbAis/1wg6pxQy4ZGPk:LjekmD2X5t73MbAis/6DTQjz
TLSH 9205BE3B72918E22C24A5373C5C7590087E6554776ABF70B318813D61E873EEEA4B2DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
98ed51e4a5c819bf8a7f2979c52b16ad
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
p5K7jhOIE1IrLXV4tU.ABABd9XoFrkZe38ZK5
IwvnOcTdXPqyDyRY0v.92YLUU9qHY88NBUE0Q
SDwnw4W65sJc27QohJ.fskqyPRfFI0ZnnRxhH
rEp2il8d09P9hANd4B.VWr3Glh0l8wFYenlnc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ofskvohve.exe
Full Name
Ofskvohve.exe
EntryPoint
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Scope Name
Ofskvohve.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ofskvohve
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0198: ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
nop <null>
ldsfld sGcOKFSWUVpXfywhP14 sGcOKFSWUVpXfywhP14::w1aSR0u3ip
call System.Byte[] sGcOKFSWUVpXfywhP14::UOaSZ6w3Pc(sGcOKFSWUVpXfywhP14)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_4002ffb1feeb44fe92d5b42176eca687
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0096: ldc.i4 388637667
ldc.i4 388637667
ldc.i4 284905922
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_7dba562297e849958a7a53993f505eed
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
ldc.i4 606302042
ldc.i4 -73879019
xor <null>
ldc.i4 -921958840
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_a718100e283d4a2a8ca75755c1045f03
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
newobj System.Void DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld UHRrw8S3Ap3VvfNI38k UHRrw8S3Ap3VvfNI38k::tkFSi5lv33
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 UHRrw8S3Ap3VvfNI38k::UOaSZ6w3Pc(System.Object,System.Byte[],UHRrw8S3Ap3VvfNI38k)
ldsfld BBDsgLSeWoHqtW7wfZH BBDsgLSeWoHqtW7wfZH::AXfSgcY6Go
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 BBDsgLSeWoHqtW7wfZH::UOaSZ6w3Pc(System.Object,BBDsgLSeWoHqtW7wfZH)
ldsfld qtsaekSLgIjD5f1d3xJ qtsaekSLgIjD5f1d3xJ::Ua4Sw4BCDW
call System.Void qtsaekSLgIjD5f1d3xJ::UOaSZ6w3Pc(System.Object,qtsaekSLgIjD5f1d3xJ)
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_f858fbeea8ec4819b80e4bd654fcf124
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_e48d6741791049c99433c7f1b60c0a43
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 3
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0153: ldloc V_1
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 6
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_d14793e611a4496f8726d71cf39c604f
brtrue IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
ret <null>
ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
call System.Void Xp8EEYSOouTNAb5h5ZL::UOaSZ6w3Pc(Xp8EEYSOouTNAb5h5ZL)
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_742df211f91c46f4a436d77c875a642e
brfalse IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
Module Name
Ofskvohve.exe
Full Name
Ofskvohve.exe
EntryPoint
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Scope Name
Ofskvohve.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ofskvohve
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0198: ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
nop <null>
ldsfld sGcOKFSWUVpXfywhP14 sGcOKFSWUVpXfywhP14::w1aSR0u3ip
call System.Byte[] sGcOKFSWUVpXfywhP14::UOaSZ6w3Pc(sGcOKFSWUVpXfywhP14)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_4002ffb1feeb44fe92d5b42176eca687
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0096: ldc.i4 388637667
ldc.i4 388637667
ldc.i4 284905922
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_7dba562297e849958a7a53993f505eed
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
ldc.i4 606302042
ldc.i4 -73879019
xor <null>
ldc.i4 -921958840
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_a718100e283d4a2a8ca75755c1045f03
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
newobj System.Void DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld UHRrw8S3Ap3VvfNI38k UHRrw8S3Ap3VvfNI38k::tkFSi5lv33
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 UHRrw8S3Ap3VvfNI38k::UOaSZ6w3Pc(System.Object,System.Byte[],UHRrw8S3Ap3VvfNI38k)
ldsfld BBDsgLSeWoHqtW7wfZH BBDsgLSeWoHqtW7wfZH::AXfSgcY6Go
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 BBDsgLSeWoHqtW7wfZH::UOaSZ6w3Pc(System.Object,BBDsgLSeWoHqtW7wfZH)
ldsfld qtsaekSLgIjD5f1d3xJ qtsaekSLgIjD5f1d3xJ::Ua4Sw4BCDW
call System.Void qtsaekSLgIjD5f1d3xJ::UOaSZ6w3Pc(System.Object,qtsaekSLgIjD5f1d3xJ)
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_f858fbeea8ec4819b80e4bd654fcf124
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_e48d6741791049c99433c7f1b60c0a43
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 3
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0153: ldloc V_1
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 6
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_d14793e611a4496f8726d71cf39c604f
brtrue IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
ret <null>
ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
call System.Void Xp8EEYSOouTNAb5h5ZL::UOaSZ6w3Pc(Xp8EEYSOouTNAb5h5ZL)
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_742df211f91c46f4a436d77c875a642e
brfalse IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
98ed51e4a5c819bf8a7f2979c52b16ad
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
p5K7jhOIE1IrLXV4tU.ABABd9XoFrkZe38ZK5
IwvnOcTdXPqyDyRY0v.92YLUU9qHY88NBUE0Q
SDwnw4W65sJc27QohJ.fskqyPRfFI0ZnnRxhH
rEp2il8d09P9hANd4B.VWr3Glh0l8wFYenlnc
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙