Deep Malware Analysis of a012b3f6345f28f58bb54aa620dc815f | md5: a012b3f6345f28f58bb54aa620dc815f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.89

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	a012b3f6345f28f58bb54aa620dc815f
Sha1	abf6948fd8cb012cf6ea0d9a61366d6ba3279dea
Sha256	c28f3bec83935b19e652533c1dd08815cb703c39cf1bd5b8fc260f52cfd0ff39
Sha384	de61664345bf3b75e43706100ad640eeca456a2a1548405f3e019d347df70dd09de666043e45b136604fc27eb0a88aef
Sha512	d0f9fd1ec8f93d78b591040a12eafffc8e1511782b58b719071281b6544047ceafbb5e805df0358394c97e29549d8985a56d88fcb1319b896869d5261ce5ef04
SSDeep	6144:3xJ9BNLp703b4rUvO/2nssPtf2XjNiqTX14p8iZ:BXBVp75Cjv52XLXs
TLSH	2584291B76568F21D2880232C1E7450183E5654BBA77E71E7A8423DB29033FBEE4B797

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Yuipzpiyvmo.exe
Full Name	Yuipzpiyvmo.exe
EntryPoint	System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name	Yuipzpiyvmo.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Yuipzpiyvmo
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count	63
Main IL	ldc.i4 2 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0009: ldloc V_0 br IL_0031: nop nop <null> newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor() call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz() callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[]) ldc.i4 0 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe brtrue IL_0072: switch(IL_008E) pop <null> ldc.i4 5 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006E: ldloc V_1 br IL_008E: leave IL_0105 leave IL_0105: ret pop <null> ldc.i4 0 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 1 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0105 leave IL_0105: ret ldc.i4 5 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3 brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106) pop <null> ldc.i4 0 br IL_000D: switch(IL_0105,IL_0031,IL_0106) ret <null> call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 3 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106) pop <null> ldc.i4 1 br IL_000D: switch(IL_0105,IL_0031,IL_0106)
Module Name	Yuipzpiyvmo.exe
Full Name	Yuipzpiyvmo.exe
EntryPoint	System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Scope Name	Yuipzpiyvmo.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Yuipzpiyvmo
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void GokDG7cTj2x9N1lrO6.tyl5rpAyqFdnWv48gm::mBooCY8Rb()
Main IL Instruction Count	63
Main IL	ldc.i4 2 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0009: ldloc V_0 br IL_0031: nop nop <null> newobj System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::.ctor() call System.Byte[] Dmpxvxt.Properties.Hbuyz::get_Fuhgiz() callvirt System.Void KUn3oxURouvNoO57b6.rn9sa1taWmmt8kr117::qciQNGmew(System.Byte[]) ldc.i4 0 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_105441322ee742299ee3d14c830feabe brtrue IL_0072: switch(IL_008E) pop <null> ldc.i4 5 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006E: ldloc V_1 br IL_008E: leave IL_0105 leave IL_0105: ret pop <null> ldc.i4 0 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_cf1f5a4bb4d94a9ca22925155a2a54ee brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 1 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0105 leave IL_0105: ret ldc.i4 5 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d4123b0990244002997c23c559c20db3 brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106) pop <null> ldc.i4 0 br IL_000D: switch(IL_0105,IL_0031,IL_0106) ret <null> call System.Void rnBHt34RN4UImin75qk.oXPCd341cImYa3xF2rC::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 3 ldsfld <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5} <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_d8aff807b4a546b6897ed2244e4d67d8 ldfld System.Int32 <Module>{de6072c2-f674-4a44-9942-d5559c7d4fc5}::m_659c4dcaac9b4623bf23b5918b676bdf brfalse IL_000D: switch(IL_0105,IL_0031,IL_0106) pop <null> ldc.i4 1 br IL_000D: switch(IL_0105,IL_0031,IL_0106)