Malicious
Malicious

a012b3f6345f28f58bb54aa620dc815f

PE Executable
MD5: a012b3f6345f28f58bb54aa620dc815f
Size: 387.07 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a012b3f6345f28f58bb54aa620dc815f
Sha1 abf6948fd8cb012cf6ea0d9a61366d6ba3279dea
Sha256 c28f3bec83935b19e652533c1dd08815cb703c39cf1bd5b8fc260f52cfd0ff39
Sha384 de61664345bf3b75e43706100ad640eeca456a2a1548405f3e019d347df70dd09de666043e45b136604fc27eb0a88aef
Sha512 d0f9fd1ec8f93d78b591040a12eafffc8e1511782b58b719071281b6544047ceafbb5e805df0358394c97e29549d8985a56d88fcb1319b896869d5261ce5ef04
SSDeep 6144:3xJ9BNLp703b4rUvO/2nssPtf2XjNiqTX14p8iZ:BXBVp75Cjv52XLXs
TLSH 2584291B76568F21D2880232C1E7450183E5654BBA77E71E7A8423DB29033FBEE4B797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a012b3f6345f28f58bb54aa620dc815f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lojNZEX4ZFYPQUpRiK.DFZPHGkTh5CE1fqKyc
7RNCcr9ytr1TDGnqDh.4eMROceL7K1THBdQE1
exFvXHVNjyyAMGo522.JHVDSPyC0Bd1dQQbvF
pUo7kuE2QI2ZfWgbDm.hK0nek4dKOaiC0fVbr
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Yuipzpiyvmo.exe
Full Name
Yuipzpiyvmo.exe
EntryPoint
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name
Yuipzpiyvmo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yuipzpiyvmo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0009: ldloc V_0
br IL_0031: nop
nop <null>
newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor()
call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz()
callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[])
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 5
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_006E: ldloc V_1
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 5
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 3
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf
brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
Module Name
Yuipzpiyvmo.exe
Full Name
Yuipzpiyvmo.exe
EntryPoint
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name
Yuipzpiyvmo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yuipzpiyvmo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0009: ldloc V_0
br IL_0031: nop
nop <null>
newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor()
call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz()
callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[])
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 5
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_006E: ldloc V_1
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 5
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 3
ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8
ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf
brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
a012b3f6345f28f58bb54aa620dc815f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lojNZEX4ZFYPQUpRiK.DFZPHGkTh5CE1fqKyc
7RNCcr9ytr1TDGnqDh.4eMROceL7K1THBdQE1
exFvXHVNjyyAMGo522.JHVDSPyC0Bd1dQQbvF
pUo7kuE2QI2ZfWgbDm.hK0nek4dKOaiC0fVbr
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙