Malicious
Malicious

a012b3f6345f28f58bb54aa620dc815f

PE Executable
MD5: a012b3f6345f28f58bb54aa620dc815f
Size: 387.07 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
387.07 KB · 387,072 B
First seen
2026-07-15 07:01 · 3 months ago
Last seen
2026-07-15 07:01 · 3 months ago
Last analysis
2026-07-15 07:02 · 3 months ago
Hashes
MD5 a012b3f6345f28f58bb54aa620dc815f Sha1 abf6948fd8cb012cf6ea0d9a61366d6ba3279dea Sha256 c28f3bec83935b19e652533c1dd08815cb703c39cf1bd5b8fc260f52cfd0ff39 Sha384 de61664345bf3b75e43706100ad640eeca456a2a1548405f3e019d347df70dd09de666043e45b136604fc27eb0a88aef Sha512 d0f9fd1ec8f93d78b591040a12eafffc8e1511782b58b719071281b6544047ceafbb5e805df0358394c97e29549d8985a56d88fcb1319b896869d5261ce5ef04 SSDeep 6144:3xJ9BNLp703b4rUvO/2nssPtf2XjNiqTX14p8iZ:BXBVp75Cjv52XLXs TLSH 2584291B76568F21D2880232C1E7450183E5654BBA77E71E7A8423DB29033FBEE4B797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEa012b3f6345f28f58bb54aa620dc815f
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINlojNZEX4ZFYPQUpRiK.DFZPHGkTh5CE1fqKyc
BIN7RNCcr9ytr1TDGnqDh.4eMROceL7K1THBdQE1
BINexFvXHVNjyyAMGo522.JHVDSPyC0Bd1dQQbvF
BINpUo7kuE2QI2ZfWgbDm.hK0nek4dKOaiC0fVbr
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Yuipzpiyvmo.exe
Full Name
Yuipzpiyvmo.exe
EntryPoint
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name
Yuipzpiyvmo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yuipzpiyvmo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0009: ldloc V_0
br IL_0031: nop
nop <null>
newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor()
call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz()
callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[])
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 5
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_006E: ldloc V_1
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 5
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 3
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf
brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
Module Name
Yuipzpiyvmo.exe
Full Name
Yuipzpiyvmo.exe
EntryPoint
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name
Yuipzpiyvmo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yuipzpiyvmo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0009: ldloc V_0
br IL_0031: nop
nop <null>
newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor()
call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz()
callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[])
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 5
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_006E: ldloc V_1
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 5
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 3
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf
brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
1 malicious · 7 files
EXEa012b3f6345f28f58bb54aa620dc815f
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙