Malicious
Malicious

9b12f6b474b40bdf5a09847fa8d551f0

PE Executable
MD5: 9b12f6b474b40bdf5a09847fa8d551f0
Size: 572.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
572.93 KB · 572,928 B
First seen
2026-10-01 09:15 · 24 days ago
Last seen
2026-10-01 09:15 · 24 days ago
Last analysis
2026-10-01 09:15 · 24 days ago
Hashes
MD5 9b12f6b474b40bdf5a09847fa8d551f0 Sha1 911dc0bb11493edbed1ded0b1f3fbb26fe734846 Sha256 1fc7a04a781a1575a953f071651daef9796ca7a0ae8321f135f548f9467ca8b9 Sha384 ad63bb38133b09eb8fcdc463479551ecaa9af81f70b036d9f803d14c11d3dcf1989435b2705561f30516661b50cd956c Sha512 7c34446c34aa2407effce40402256487f40f648c8f2102e023cab271a3fcd16ab2565ff6783012fe72bca179f173ab9ec362b168e3a9e9d3093c1a96b650fee7 SSDeep 12288:aCyCfUAsFXbaqdz2JAZDK8YWsT/gXU+BA:aMsAAhdzYAZ3q+BA TLSH 36C46B2B36664E51C5850B77C1DBA50083E29686BEEBF70F724013A52D433FFDA4B692
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE9b12f6b474b40bdf5a09847fa8d551f0
Structure
BIN.Net Resources
BINwQWLDng2fPWfFwqnWR.WhhjKt2CeybaMIIqmp
BINE7f2HeB6K658ifHRky.BKSEpaJywKGGVQ1CHh
BINuaqLbHcQielE5CxsMt.5kqYkjOOphdMdRnEPP
BINBDH5BTwl4lbWFjOJYO.OS3aSgejCGhthxFLxZ
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Znxkbnid.exe
Full Name
Znxkbnid.exe
EntryPoint
System.Void wHvAqR3ckIlxmfbitN.RUfYx9HXjGbb4KJ00w::Gs0LhPZDm()
Scope Name
Znxkbnid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znxkbnid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wHvAqR3ckIlxmfbitN.RUfYx9HXjGbb4KJ00w::Gs0LhPZDm()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_01AB: ret
ldsfld oWfJs8HutTuClHg9ZR9 oWfJs8HutTuClHg9ZR9::WAXHxHZPP0
call System.Void oWfJs8HutTuClHg9ZR9::lwpH938jnm(oWfJs8HutTuClHg9ZR9)
ldc.i4 5
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_8774b6d3ae3443bb8679db8ed27f8c1b
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01AB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AB)
nop <null>
ldsfld SIfrFPHfYPq8oUuI8xr SIfrFPHfYPq8oUuI8xr::zxxHnYpXBS
call System.Byte[] SIfrFPHfYPq8oUuI8xr::lwpH938jnm(SIfrFPHfYPq8oUuI8xr)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_f731efcab2a14a0cb3cdca34529c900e
brtrue IL_009F: switch(IL_0134,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0134,IL_00BF)
br IL_009B: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009B: ldloc V_3
br IL_0134: leave IL_01AB
ldc.i4 -829642128
ldc.i4 -235743643
xor <null>
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_e7683f72de4d4ce68d1c0ebcda2e4422
xor <null>
ldsfld cMT3MDHqIMu0h7aoMma cMT3MDHqIMu0h7aoMma::W90HT0n5wr
call System.String cMT3MDHqIMu0h7aoMma::lwpH938jnm(System.Int32,cMT3MDHqIMu0h7aoMma)
ldc.i4 1146343007
ldc.i4 1993152331
xor <null>
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_420f198fdb374084ae9219a5c4ed377c
xor <null>
ldsfld cMT3MDHqIMu0h7aoMma cMT3MDHqIMu0h7aoMma::W90HT0n5wr
call System.String cMT3MDHqIMu0h7aoMma::lwpH938jnm(System.Int32,cMT3MDHqIMu0h7aoMma)
newobj System.Void ofm9AuhL7iRxZjMdXY.ROR7GKVrBWWEyPRqLB::.ctor(System.String,System.String)
newobj System.Void enCM9JecAwBAwhANJoN.RCuoOQeJ2vrA7fkq4bK::.ctor(ofm9AuhL7iRxZjMdXY.ROR7GKVrBWWEyPRqLB)
ldloc.s V_2
ldsfld eGvsLfHtG4DMyp1neXY eGvsLfHtG4DMyp1neXY::BVrHzZMfup
call System.Void eGvsLfHtG4DMyp1neXY::lwpH938jnm(System.Object,System.Byte[],eGvsLfHtG4DMyp1neXY)
ldc.i4 0
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_0c97c1c6c9604aa3a105386eb74c4291
brfalse IL_009F: switch(IL_0134,IL_00BF)
pop <null>
ldc.i4 6
br IL_009F: switch(IL_0134,IL_00BF)
leave IL_01AB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_420f198fdb374084ae9219a5c4ed377c
brfalse IL_016B: switch(IL_0187)
pop <null>
ldc.i4 0
br IL_016B: switch(IL_0187)
br IL_0167: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0167: ldloc V_1
br IL_0187: leave IL_01AB
leave IL_01AB: ret
ldc.i4 2
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_52197f468d3740a48d7a116fce21e27c
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01AB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01AB)
ret <null>
Module Name
Znxkbnid.exe
Full Name
Znxkbnid.exe
EntryPoint
System.Void wHvAqR3ckIlxmfbitN.RUfYx9HXjGbb4KJ00w::Gs0LhPZDm()
Scope Name
Znxkbnid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Znxkbnid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wHvAqR3ckIlxmfbitN.RUfYx9HXjGbb4KJ00w::Gs0LhPZDm()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_01AB: ret
ldsfld oWfJs8HutTuClHg9ZR9 oWfJs8HutTuClHg9ZR9::WAXHxHZPP0
call System.Void oWfJs8HutTuClHg9ZR9::lwpH938jnm(oWfJs8HutTuClHg9ZR9)
ldc.i4 5
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_8774b6d3ae3443bb8679db8ed27f8c1b
brfalse IL_0014: switch(IL_0061,IL_0038,IL_01AB)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0038,IL_01AB)
nop <null>
ldsfld SIfrFPHfYPq8oUuI8xr SIfrFPHfYPq8oUuI8xr::zxxHnYpXBS
call System.Byte[] SIfrFPHfYPq8oUuI8xr::lwpH938jnm(SIfrFPHfYPq8oUuI8xr)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_f731efcab2a14a0cb3cdca34529c900e
brtrue IL_009F: switch(IL_0134,IL_00BF)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_0134,IL_00BF)
br IL_009B: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009B: ldloc V_3
br IL_0134: leave IL_01AB
ldc.i4 -829642128
ldc.i4 -235743643
xor <null>
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_e7683f72de4d4ce68d1c0ebcda2e4422
xor <null>
ldsfld cMT3MDHqIMu0h7aoMma cMT3MDHqIMu0h7aoMma::W90HT0n5wr
call System.String cMT3MDHqIMu0h7aoMma::lwpH938jnm(System.Int32,cMT3MDHqIMu0h7aoMma)
ldc.i4 1146343007
ldc.i4 1993152331
xor <null>
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_420f198fdb374084ae9219a5c4ed377c
xor <null>
ldsfld cMT3MDHqIMu0h7aoMma cMT3MDHqIMu0h7aoMma::W90HT0n5wr
call System.String cMT3MDHqIMu0h7aoMma::lwpH938jnm(System.Int32,cMT3MDHqIMu0h7aoMma)
newobj System.Void ofm9AuhL7iRxZjMdXY.ROR7GKVrBWWEyPRqLB::.ctor(System.String,System.String)
newobj System.Void enCM9JecAwBAwhANJoN.RCuoOQeJ2vrA7fkq4bK::.ctor(ofm9AuhL7iRxZjMdXY.ROR7GKVrBWWEyPRqLB)
ldloc.s V_2
ldsfld eGvsLfHtG4DMyp1neXY eGvsLfHtG4DMyp1neXY::BVrHzZMfup
call System.Void eGvsLfHtG4DMyp1neXY::lwpH938jnm(System.Object,System.Byte[],eGvsLfHtG4DMyp1neXY)
ldc.i4 0
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_0c97c1c6c9604aa3a105386eb74c4291
brfalse IL_009F: switch(IL_0134,IL_00BF)
pop <null>
ldc.i4 6
br IL_009F: switch(IL_0134,IL_00BF)
leave IL_01AB: ret
pop <null>
ldc.i4 1
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_420f198fdb374084ae9219a5c4ed377c
brfalse IL_016B: switch(IL_0187)
pop <null>
ldc.i4 0
br IL_016B: switch(IL_0187)
br IL_0167: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0167: ldloc V_1
br IL_0187: leave IL_01AB
leave IL_01AB: ret
ldc.i4 2
ldsfld <Module>{22493f85-7f5f-48ed-9a56-643c55901cac} <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_026cca37147c4dc190e3db27c5c3a24e
ldfld System.Int32 <Module>{22493f85-7f5f-48ed-9a56-643c55901cac}::m_52197f468d3740a48d7a116fce21e27c
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01AB)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0061,IL_0038,IL_01AB)
ret <null>
1 malicious · 7 files
EXE9b12f6b474b40bdf5a09847fa8d551f0
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙