Suspicious
Suspect

a3d3d4bf23539d99f124c2afc6484ad6

Share on LinkedIn
Print
PE Executable
MD5: a3d3d4bf23539d99f124c2afc6484ad6
Size: 1.11 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a3d3d4bf23539d99f124c2afc6484ad6
Sha1 9cc8f27638469624545219535b75351e93cbec2c
Sha256 54a49d9771307f97f1cdcdb468e4a38adebe3f42678a3ad178feab614f2b5bee
Sha384 080cd1cbf625099d0a545c35ea4caa8dc6ce4d13f056d9c217c5653c66f84c8d68e0dd35b630095a6a3d65f85f14932d
Sha512 081b41f5e00e596d9c52e5fcbb44701de621dc2867913f7f7cec4fc501ad20e33e9e34892603d89dfe7a0b209a153279fe35bf997f0afc50f7795829d5e0846b
SSDeep 24576:hNwUS2UxAPqGcv/+Duyx46QoDPHD/Sfn:hN7+qPRcvEFQoDP8
TLSH 6D35F0259DCB5A14CB3D4A78C1A6189823F0D613C32BE76F3EF9A1F48F96B856D17042
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a3d3d4bf23539d99f124c2afc6484ad6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Genitalk.klaoxao.tiff
Nw1jf.Resources.resources
b521966ac51fb6.Resources.resources
c54de0b90
[NBF]root.Data
c54de0b91
[NBF]root.Data
c54de0b910
[NBF]root.Data
c54de0b911
[NBF]root.Data
c54de0b912
[NBF]root.Data
c54de0b913
[NBF]root.Data
c54de0b914
[NBF]root.Data
c54de0b915
[NBF]root.Data
c54de0b916
[NBF]root.Data
c54de0b917
[NBF]root.Data
c54de0b918
[NBF]root.Data
c54de0b919
[NBF]root.Data
c54de0b92
[NBF]root.Data
c54de0b920
[NBF]root.Data
c54de0b921
[NBF]root.Data
c54de0b922
[NBF]root.Data
c54de0b93
[NBF]root.Data
c54de0b94
[NBF]root.Data
c54de0b95
[NBF]root.Data
c54de0b96
[NBF]root.Data
c54de0b97
[NBF]root.Data
c54de0b98
[NBF]root.Data
c54de0b99
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nw1jf
Full Name
Nw1jf
EntryPoint
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Scope Name
Nw1jf
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nw1jf
Assembly Version
8.19.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Main IL Instruction Count
67
Main IL 
ldc.i4.7 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean zj3R_4Df.2tqKi0Sond4Y8Q::1oxNxX7ma9eDj()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.4
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.4 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::pr5Bj9Tc()
nop <null>
nop <null>
ldc.i8 13
ldc.i4.5 <null>
ldc.i4 1189007946
call System.String Ray9f5LbP.9byPeCz5R0::iw2Qy6C(System.Int64,System.Int32,System.Int32)
nop <null>
ldc.i4 225
ldnull <null>
ldc.i4 1089293018
ldc.i4.5 <null>
call System.String 8pwAq5Dg4.3pmWtdT9/9noYk3Rb5CirBx.cy3RZ5taxq0::iCo8is7B(System.Char,System.Reflection.Assembly,System.Int32,System.Int32)
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::Zfy5dL(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void zj3R_4Df.2tqKi0Sond4Y8Q::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
pop <null>
ret <null>
Module Name
Nw1jf
Full Name
Nw1jf
EntryPoint
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Scope Name
Nw1jf
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nw1jf
Assembly Version
8.19.20.91
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
Main IL Instruction Count
67
Main IL 
ldc.i4.7 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.i4.s 25
ldc.i4.6 <null>
ldc.i4 2026
call System.DateTime Microsoft.VisualBasic.DateAndTime::DateSerial(System.Int32,System.Int32,System.Int32)
stloc.0 <null>
ldloca.s V_1
initobj Microsoft.VisualBasic.FirstDayOfWeek
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.2 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Boolean zj3R_4Df.2tqKi0Sond4Y8Q::1oxNxX7ma9eDj()
ldc.i4.0 <null>
ceq <null>
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_0064: ldc.i4.4
ldc.i4.3 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
ldc.i4.4 <null>
br.s IL_0060: stloc.s V_4
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br.s IL_0003: ldloc.s V_4
nop <null>
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::pr5Bj9Tc()
nop <null>
nop <null>
ldc.i8 13
ldc.i4.5 <null>
ldc.i4 1189007946
call System.String Ray9f5LbP.9byPeCz5R0::iw2Qy6C(System.Int64,System.Int32,System.Int32)
nop <null>
ldc.i4 225
ldnull <null>
ldc.i4 1089293018
ldc.i4.5 <null>
call System.String 8pwAq5Dg4.3pmWtdT9/9noYk3Rb5CirBx.cy3RZ5taxq0::iCo8is7B(System.Char,System.Reflection.Assembly,System.Int32,System.Int32)
call System.Void zj3R_4Df.2tqKi0Sond4Y8Q::Zfy5dL(System.String,System.String)
ldc.i4.5 <null>
stloc.s V_4
br IL_0003: ldloc.s V_4
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
newobj System.Void zj3R_4Df.2tqKi0Sond4Y8Q::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
ret <null>
ldtoken System.Void zj3R_4Df.2tqKi0Sond4Y8Q::2btGfdX0J8rs()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙