Malicious
Malicious

98ed51e4a5c819bf8a7f2979c52b16ad

Share on LinkedIn
Print
PE Executable
MD5: 98ed51e4a5c819bf8a7f2979c52b16ad
Size: 827.39 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 98ed51e4a5c819bf8a7f2979c52b16ad
Sha1 80712e817812528ef2ad04959714e21f9f0ff1ff
Sha256 d2338a127bed46401ea37a76e83166276b4f73cc1c171594b6383001a3e0cb4e
Sha384 bef39bc3218d8aad6b021bcf8b1d20fbf73d6734e212301d58321511e95ca266f4b778cda58710baf7cfe9bca3b31b72
Sha512 d754f195e4734c9e579248c73fc918e9a07faa9d5b4f989c203e8e40231260f35d6c7e4f72da3a3be86a28e4c1ecc48b1a94d47f03355a13b9ad031404e969aa
SSDeep 12288:Oqf9FO4jYkmD2B4T25t7DKGGgPUbAis/1wg6pxQy4ZGPk:LjekmD2X5t73MbAis/6DTQjz
TLSH 9205BE3B72918E22C24A5373C5C7590087E6554776ABF70B318813D61E873EEEA4B2DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
98ed51e4a5c819bf8a7f2979c52b16ad
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
p5K7jhOIE1IrLXV4tU.ABABd9XoFrkZe38ZK5
IwvnOcTdXPqyDyRY0v.92YLUU9qHY88NBUE0Q
SDwnw4W65sJc27QohJ.fskqyPRfFI0ZnnRxhH
rEp2il8d09P9hANd4B.VWr3Glh0l8wFYenlnc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ofskvohve.exe
Full Name
Ofskvohve.exe
EntryPoint
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Scope Name
Ofskvohve.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ofskvohve
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0198: ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
nop <null>
ldsfld sGcOKFSWUVpXfywhP14 sGcOKFSWUVpXfywhP14::w1aSR0u3ip
call System.Byte[] sGcOKFSWUVpXfywhP14::UOaSZ6w3Pc(sGcOKFSWUVpXfywhP14)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_4002ffb1feeb44fe92d5b42176eca687
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0096: ldc.i4 388637667
ldc.i4 388637667
ldc.i4 284905922
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_7dba562297e849958a7a53993f505eed
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
ldc.i4 606302042
ldc.i4 -73879019
xor <null>
ldc.i4 -921958840
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_a718100e283d4a2a8ca75755c1045f03
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
newobj System.Void DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld UHRrw8S3Ap3VvfNI38k UHRrw8S3Ap3VvfNI38k::tkFSi5lv33
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 UHRrw8S3Ap3VvfNI38k::UOaSZ6w3Pc(System.Object,System.Byte[],UHRrw8S3Ap3VvfNI38k)
ldsfld BBDsgLSeWoHqtW7wfZH BBDsgLSeWoHqtW7wfZH::AXfSgcY6Go
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 BBDsgLSeWoHqtW7wfZH::UOaSZ6w3Pc(System.Object,BBDsgLSeWoHqtW7wfZH)
ldsfld qtsaekSLgIjD5f1d3xJ qtsaekSLgIjD5f1d3xJ::Ua4Sw4BCDW
call System.Void qtsaekSLgIjD5f1d3xJ::UOaSZ6w3Pc(System.Object,qtsaekSLgIjD5f1d3xJ)
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_f858fbeea8ec4819b80e4bd654fcf124
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_e48d6741791049c99433c7f1b60c0a43
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 3
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0153: ldloc V_1
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 6
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_d14793e611a4496f8726d71cf39c604f
brtrue IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
ret <null>
ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
call System.Void Xp8EEYSOouTNAb5h5ZL::UOaSZ6w3Pc(Xp8EEYSOouTNAb5h5ZL)
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_742df211f91c46f4a436d77c875a642e
brfalse IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
Module Name
Ofskvohve.exe
Full Name
Ofskvohve.exe
EntryPoint
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Scope Name
Ofskvohve.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ofskvohve
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void d4x5b8aPMSli0YskYk.U32El2Sr80VccObgIF::nZ437B1in()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0198: ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
nop <null>
ldsfld sGcOKFSWUVpXfywhP14 sGcOKFSWUVpXfywhP14::w1aSR0u3ip
call System.Byte[] sGcOKFSWUVpXfywhP14::UOaSZ6w3Pc(sGcOKFSWUVpXfywhP14)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_4002ffb1feeb44fe92d5b42176eca687
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 4
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0096: ldc.i4 388637667
ldc.i4 388637667
ldc.i4 284905922
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_7dba562297e849958a7a53993f505eed
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
ldc.i4 606302042
ldc.i4 -73879019
xor <null>
ldc.i4 -921958840
xor <null>
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_a718100e283d4a2a8ca75755c1045f03
xor <null>
ldsfld sLvYBZSSNCmKTxy0oIf sLvYBZSSNCmKTxy0oIf::p4DSa0ClvY
call System.String sLvYBZSSNCmKTxy0oIf::UOaSZ6w3Pc(System.Int32,sLvYBZSSNCmKTxy0oIf)
newobj System.Void DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5::.ctor(System.String,System.String)
ldloc.s V_3
ldsfld UHRrw8S3Ap3VvfNI38k UHRrw8S3Ap3VvfNI38k::tkFSi5lv33
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 UHRrw8S3Ap3VvfNI38k::UOaSZ6w3Pc(System.Object,System.Byte[],UHRrw8S3Ap3VvfNI38k)
ldsfld BBDsgLSeWoHqtW7wfZH BBDsgLSeWoHqtW7wfZH::AXfSgcY6Go
call DAoJfj8mboHjm02j2bc.MpQ9tF8ZnLExAqGvoK5 BBDsgLSeWoHqtW7wfZH::UOaSZ6w3Pc(System.Object,BBDsgLSeWoHqtW7wfZH)
ldsfld qtsaekSLgIjD5f1d3xJ qtsaekSLgIjD5f1d3xJ::Ua4Sw4BCDW
call System.Void qtsaekSLgIjD5f1d3xJ::UOaSZ6w3Pc(System.Object,qtsaekSLgIjD5f1d3xJ)
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_f858fbeea8ec4819b80e4bd654fcf124
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_e48d6741791049c99433c7f1b60c0a43
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 3
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0153: ldloc V_1
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 6
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_d14793e611a4496f8726d71cf39c604f
brtrue IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
ret <null>
ldsfld Xp8EEYSOouTNAb5h5ZL Xp8EEYSOouTNAb5h5ZL::BCoSXKHuVd
call System.Void Xp8EEYSOouTNAb5h5ZL::UOaSZ6w3Pc(Xp8EEYSOouTNAb5h5ZL)
ldc.i4 1
ldsfld <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7} <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_55f504798c024bddb009d8820d78e908
ldfld System.Int32 <Module>{e3dc6d56-07ed-4489-a194-f743cd2839f7}::m_742df211f91c46f4a436d77c875a642e
brfalse IL_0014: switch(IL_0197,IL_0038,IL_0198)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0197,IL_0038,IL_0198)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙