Malicious
Malicious

a5e2c4840de06638194947d9911b2f59

PE Executable
MD5: a5e2c4840de06638194947d9911b2f59
Size: 429.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
429.06 KB · 429,056 B
First seen
2026-08-20 06:16 · 2 months ago
Last seen
2026-08-20 06:16 · 2 months ago
Last analysis
2026-08-20 06:16 · 2 months ago
Hashes
MD5 a5e2c4840de06638194947d9911b2f59 Sha1 7b6b8c7106e76368578bc9da07c93ae8271fc864 Sha256 3ee5f618155e38ed17e596144ca35fd7e2ad91fd9b42016eeb1ee7c0680da32e Sha384 9cf1d416f23d5896b314401caa05307b4c3e0aae5d59ef70a3b6c92ab11fedc3261b670c71d807b57c4ee9a64bd262a8 Sha512 258dd200542ef648270acda7749328620df4b2d6a5f7124fce1657428b6a76a782740d634b47db0a46ec0e7e33b782ebe633a82c8596c3ec8af2250e07f76a5d SSDeep 6144:pKrinVVJajVzoLiuJavJe0LmX4iuPRna:pvVWjSLiuJn0Lmf+Rna TLSH 5E944A3A37924E26C14A4373C1C74A00C7E6968776ABFB0B328513D61D463FEDE4A697
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEa5e2c4840de06638194947d9911b2f59
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINTaAjQZlcg7iXKgmcKR.EfJwilQ2fJhN1oOXAL
BINBhyXE0vtbUS0mdF7XC.mCj5dDFcsltIic4QkG
BINMyAanS0xoCBYB3bFfq.Hih4w2YG5Q9LPln9l2
BINjKa51tkPEP4YxbsdZn.SdjCCOooQDOaEsfB8G
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Sjrfiwxstni.exe
Full Name
Sjrfiwxstni.exe
EntryPoint
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Scope Name
Sjrfiwxstni.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sjrfiwxstni
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0198: ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
nop <null>
ldsfld J8A320O0KY5DEhaCDJr J8A320O0KY5DEhaCDJr::nCUOYJRLB6
call System.Byte[] J8A320O0KY5DEhaCDJr::vUZOH9M29V(J8A320O0KY5DEhaCDJr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_bed0ba641a30451b87748fe51621a145
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_0197
ldc.i4 -918278103
ldc.i4 -397099114
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_93adda74442f45e78289f53165e895fd
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
ldc.i4 742358772
ldc.i4 -733620833
xor <null>
ldc.i4 -1772668385
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_557397234ceb4cd4b0f439bae837b569
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
newobj System.Void SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld M0s50POreRI8UjtiO9y M0s50POreRI8UjtiO9y::myxOBc0nhv
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW M0s50POreRI8UjtiO9y::vUZOH9M29V(System.Object,System.Byte[],M0s50POreRI8UjtiO9y)
ldsfld RIZxBYOK1qkuShypyXv RIZxBYOK1qkuShypyXv::vgBOyB6ERA
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW RIZxBYOK1qkuShypyXv::vUZOH9M29V(System.Object,RIZxBYOK1qkuShypyXv)
ldsfld BysJbIO5hit0i4LKfGH BysJbIO5hit0i4LKfGH::VG9OCIQD7Z
call System.Void BysJbIO5hit0i4LKfGH::vUZOH9M29V(System.Object,BysJbIO5hit0i4LKfGH)
ldc.i4 3
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_960a37f4ee384d34a2e4592ac9b06701
brfalse IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_41af31144b824614bf6b43b1347c5b7a
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 2
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 2
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_f9e2761d95b9461782a52e69aadca34b
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
ret <null>
ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
call System.Void S37c6vOlNUlSLi5iipx::vUZOH9M29V(S37c6vOlNUlSLi5iipx)
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_5838dd6965664208a0e47d004422da60
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
Module Name
Sjrfiwxstni.exe
Full Name
Sjrfiwxstni.exe
EntryPoint
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Scope Name
Sjrfiwxstni.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sjrfiwxstni
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0198: ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
nop <null>
ldsfld J8A320O0KY5DEhaCDJr J8A320O0KY5DEhaCDJr::nCUOYJRLB6
call System.Byte[] J8A320O0KY5DEhaCDJr::vUZOH9M29V(J8A320O0KY5DEhaCDJr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_bed0ba641a30451b87748fe51621a145
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_0197
ldc.i4 -918278103
ldc.i4 -397099114
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_93adda74442f45e78289f53165e895fd
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
ldc.i4 742358772
ldc.i4 -733620833
xor <null>
ldc.i4 -1772668385
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_557397234ceb4cd4b0f439bae837b569
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
newobj System.Void SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld M0s50POreRI8UjtiO9y M0s50POreRI8UjtiO9y::myxOBc0nhv
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW M0s50POreRI8UjtiO9y::vUZOH9M29V(System.Object,System.Byte[],M0s50POreRI8UjtiO9y)
ldsfld RIZxBYOK1qkuShypyXv RIZxBYOK1qkuShypyXv::vgBOyB6ERA
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW RIZxBYOK1qkuShypyXv::vUZOH9M29V(System.Object,RIZxBYOK1qkuShypyXv)
ldsfld BysJbIO5hit0i4LKfGH BysJbIO5hit0i4LKfGH::VG9OCIQD7Z
call System.Void BysJbIO5hit0i4LKfGH::vUZOH9M29V(System.Object,BysJbIO5hit0i4LKfGH)
ldc.i4 3
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_960a37f4ee384d34a2e4592ac9b06701
brfalse IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_41af31144b824614bf6b43b1347c5b7a
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 2
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 2
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_f9e2761d95b9461782a52e69aadca34b
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
ret <null>
ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
call System.Void S37c6vOlNUlSLi5iipx::vUZOH9M29V(S37c6vOlNUlSLi5iipx)
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_5838dd6965664208a0e47d004422da60
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
1 malicious · 7 files
EXEa5e2c4840de06638194947d9911b2f59
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙