Suspicious
Suspect

a3d3d4bf23539d99f124c2afc6484ad6

PE Executable
MD5: a3d3d4bf23539d99f124c2afc6484ad6
Size: 1.11 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a3d3d4bf23539d99f124c2afc6484ad6
Sha1 9cc8f27638469624545219535b75351e93cbec2c
Sha256 54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
Sha384 080cd1cbf625099d0a545c35ea4caa8dc6ce4d13f056d9c217c5653c66f84c8d68e0dd35b630095a6a3d65f85f14932d
Sha512 081b41f5e00e596d9c52e5fcbb44701de621dc2867913f7f7cec4fc501ad20e33e9e34892603d89dfe7a0b209a153279fe35bf997f0afc50f7795829d5e0846b
SSDeep 24576:hNwUS2UxAPqGcv/+Duyx46QoDPHD/Sfn:hN7+qPRcvEFQoDP8
TLSH 6D35F0259DCB5A14CB3D4A78C1A6189823F0D613C32BE76F3EF9A1F48F96B856D17042
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a3d3d4bf23539d99f124c2afc6484ad6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
Nw1jf.Resources.resources
b521966ac51fb6.Resources.resources
c54de0b90
[NBF]root.Data
c54de0b91
[NBF]root.Data
c54de0b910
[NBF]root.Data
c54de0b911
[NBF]root.Data
c54de0b912
[NBF]root.Data
c54de0b913
[NBF]root.Data
c54de0b914
[NBF]root.Data
c54de0b915
[NBF]root.Data
c54de0b916
[NBF]root.Data
c54de0b917
[NBF]root.Data
c54de0b918
[NBF]root.Data
c54de0b919
[NBF]root.Data
c54de0b92
[NBF]root.Data
c54de0b920
[NBF]root.Data
c54de0b921
[NBF]root.Data
c54de0b922
[NBF]root.Data
c54de0b93
[NBF]root.Data
c54de0b94
[NBF]root.Data
c54de0b95
[NBF]root.Data
c54de0b96
[NBF]root.Data
c54de0b97
[NBF]root.Data
c54de0b98
[NBF]root.Data
c54de0b99
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nw1jf
Full Name
Nw1jf
EntryPoint
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Scope Name
Nw1jf
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nw1jf
Assembly Version
8.19.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Main IL Instruction Count
67
Main IL 
ldc.i4.7 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean zj3R_4Df.2tqKi0Sond4Y8Q::1oxNxX7ma9eDj()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.4
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.4 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::pr5Bj9Tc()
nop <null>
nop <null>
ldc.i8 13
ldc.i4.5 <null>
ldc.i4 1189007946
call System.String Ray9f5LbP.9byPeCz5R0::iw2Qy6C(System.Int64,System.Int32,System.Int32)
nop <null>
ldc.i4 225
ldnull <null>
ldc.i4 1089293018
ldc.i4.5 <null>
call System.String 8pwAq5Dg4.3pmWtdT9/9noYk3Rb5CirBx.cy3RZ5taxq0::iCo8is7B(System.Char,System.Reflection.Assembly,System.Int32,System.Int32)
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::Zfy5dL(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void zj3R_4Df.2tqKi0Sond4Y8Q::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
pop <null>
ret <null>
Module Name
Nw1jf
Full Name
Nw1jf
EntryPoint
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Scope Name
Nw1jf
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nw1jf
Assembly Version
8.19.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Main IL Instruction Count
67
Main IL 
ldc.i4.7 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean zj3R_4Df.2tqKi0Sond4Y8Q::1oxNxX7ma9eDj()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.4
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.4 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::pr5Bj9Tc()
nop <null>
nop <null>
ldc.i8 13
ldc.i4.5 <null>
ldc.i4 1189007946
call System.String Ray9f5LbP.9byPeCz5R0::iw2Qy6C(System.Int64,System.Int32,System.Int32)
nop <null>
ldc.i4 225
ldnull <null>
ldc.i4 1089293018
ldc.i4.5 <null>
call System.String 8pwAq5Dg4.3pmWtdT9/9noYk3Rb5CirBx.cy3RZ5taxq0::iCo8is7B(System.Char,System.Reflection.Assembly,System.Int32,System.Int32)
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::Zfy5dL(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void zj3R_4Df.2tqKi0Sond4Y8Q::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
pop <null>
ret <null>
a3d3d4bf23539d99f124c2afc6484ad6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
Nw1jf.Resources.resources
b521966ac51fb6.Resources.resources
c54de0b90
[NBF]root.Data
c54de0b91
[NBF]root.Data
c54de0b910
[NBF]root.Data
c54de0b911
[NBF]root.Data
c54de0b912
[NBF]root.Data
c54de0b913
[NBF]root.Data
c54de0b914
[NBF]root.Data
c54de0b915
[NBF]root.Data
c54de0b916
[NBF]root.Data
c54de0b917
[NBF]root.Data
c54de0b918
[NBF]root.Data
c54de0b919
[NBF]root.Data
c54de0b92
[NBF]root.Data
c54de0b920
[NBF]root.Data
c54de0b921
[NBF]root.Data
c54de0b922
[NBF]root.Data
c54de0b93
[NBF]root.Data
c54de0b94
[NBF]root.Data
c54de0b95
[NBF]root.Data
c54de0b96
[NBF]root.Data
c54de0b97
[NBF]root.Data
c54de0b98
[NBF]root.Data
c54de0b99
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙