Malicious
Malicious

a5e2c4840de06638194947d9911b2f59

PE Executable
MD5: a5e2c4840de06638194947d9911b2f59
Size: 429.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a5e2c4840de06638194947d9911b2f59
Sha1 7b6b8c7106e76368578bc9da07c93ae8271fc864
Sha256 3ee5f618155e38ed17e596144ca35fd7e2ad91fd9b42016eeb1ee7c0680da32e
Sha384 9cf1d416f23d5896b314401caa05307b4c3e0aae5d59ef70a3b6c92ab11fedc3261b670c71d807b57c4ee9a64bd262a8
Sha512 258dd200542ef648270acda7749328620df4b2d6a5f7124fce1657428b6a76a782740d634b47db0a46ec0e7e33b782ebe633a82c8596c3ec8af2250e07f76a5d
SSDeep 6144:pKrinVVJajVzoLiuJavJe0LmX4iuPRna:pvVWjSLiuJn0Lmf+Rna
TLSH 5E944A3A37924E26C14A4373C1C74A00C7E6968776ABFB0B328513D61D463FEDE4A697
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a5e2c4840de06638194947d9911b2f59
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TaAjQZlcg7iXKgmcKR.EfJwilQ2fJhN1oOXAL
BhyXE0vtbUS0mdF7XC.mCj5dDFcsltIic4QkG
MyAanS0xoCBYB3bFfq.Hih4w2YG5Q9LPln9l2
jKa51tkPEP4YxbsdZn.SdjCCOooQDOaEsfB8G
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Sjrfiwxstni.exe
Full Name
Sjrfiwxstni.exe
EntryPoint
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Scope Name
Sjrfiwxstni.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sjrfiwxstni
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0198: ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
nop <null>
ldsfld J8A320O0KY5DEhaCDJr J8A320O0KY5DEhaCDJr::nCUOYJRLB6
call System.Byte[] J8A320O0KY5DEhaCDJr::vUZOH9M29V(J8A320O0KY5DEhaCDJr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_bed0ba641a30451b87748fe51621a145
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_0197
ldc.i4 -918278103
ldc.i4 -397099114
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_93adda74442f45e78289f53165e895fd
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
ldc.i4 742358772
ldc.i4 -733620833
xor <null>
ldc.i4 -1772668385
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_557397234ceb4cd4b0f439bae837b569
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
newobj System.Void SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld M0s50POreRI8UjtiO9y M0s50POreRI8UjtiO9y::myxOBc0nhv
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW M0s50POreRI8UjtiO9y::vUZOH9M29V(System.Object,System.Byte[],M0s50POreRI8UjtiO9y)
ldsfld RIZxBYOK1qkuShypyXv RIZxBYOK1qkuShypyXv::vgBOyB6ERA
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW RIZxBYOK1qkuShypyXv::vUZOH9M29V(System.Object,RIZxBYOK1qkuShypyXv)
ldsfld BysJbIO5hit0i4LKfGH BysJbIO5hit0i4LKfGH::VG9OCIQD7Z
call System.Void BysJbIO5hit0i4LKfGH::vUZOH9M29V(System.Object,BysJbIO5hit0i4LKfGH)
ldc.i4 3
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_960a37f4ee384d34a2e4592ac9b06701
brfalse IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_41af31144b824614bf6b43b1347c5b7a
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 2
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 2
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_f9e2761d95b9461782a52e69aadca34b
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
ret <null>
ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
call System.Void S37c6vOlNUlSLi5iipx::vUZOH9M29V(S37c6vOlNUlSLi5iipx)
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_5838dd6965664208a0e47d004422da60
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
Module Name
Sjrfiwxstni.exe
Full Name
Sjrfiwxstni.exe
EntryPoint
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Scope Name
Sjrfiwxstni.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sjrfiwxstni
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void SQetJEgmurQXt9dWL3.bByYugOdj0Nu4cBCqX::ltKripaUo()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0198: ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
nop <null>
ldsfld J8A320O0KY5DEhaCDJr J8A320O0KY5DEhaCDJr::nCUOYJRLB6
call System.Byte[] J8A320O0KY5DEhaCDJr::vUZOH9M29V(J8A320O0KY5DEhaCDJr)
stloc.s V_1
ldc.i4 1
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_bed0ba641a30451b87748fe51621a145
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 5
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0072: ldloc V_2
br IL_0120: leave IL_0197
ldc.i4 -918278103
ldc.i4 -397099114
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_93adda74442f45e78289f53165e895fd
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
ldc.i4 742358772
ldc.i4 -733620833
xor <null>
ldc.i4 -1772668385
xor <null>
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_557397234ceb4cd4b0f439bae837b569
xor <null>
ldsfld VGp4niOONWlSFt6jAI6 VGp4niOONWlSFt6jAI6::aBAOgC6IWq
call System.String VGp4niOONWlSFt6jAI6::vUZOH9M29V(System.Int32,VGp4niOONWlSFt6jAI6)
newobj System.Void SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld M0s50POreRI8UjtiO9y M0s50POreRI8UjtiO9y::myxOBc0nhv
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW M0s50POreRI8UjtiO9y::vUZOH9M29V(System.Object,System.Byte[],M0s50POreRI8UjtiO9y)
ldsfld RIZxBYOK1qkuShypyXv RIZxBYOK1qkuShypyXv::vgBOyB6ERA
call SM66CYkGpLkxvrr9yJo.oNrXVMkHN0Hj7yBCLFW RIZxBYOK1qkuShypyXv::vUZOH9M29V(System.Object,RIZxBYOK1qkuShypyXv)
ldsfld BysJbIO5hit0i4LKfGH BysJbIO5hit0i4LKfGH::VG9OCIQD7Z
call System.Void BysJbIO5hit0i4LKfGH::vUZOH9M29V(System.Object,BysJbIO5hit0i4LKfGH)
ldc.i4 3
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_960a37f4ee384d34a2e4592ac9b06701
brfalse IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0120,IL_0096)
leave IL_0197: ret
pop <null>
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_41af31144b824614bf6b43b1347c5b7a
brfalse IL_0157: switch(IL_0173)
pop <null>
ldc.i4 2
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0153: ldloc V_0
br IL_0173: leave IL_0197
leave IL_0197: ret
ldc.i4 2
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_f9e2761d95b9461782a52e69aadca34b
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
ret <null>
ldsfld S37c6vOlNUlSLi5iipx S37c6vOlNUlSLi5iipx::iMHOQUmXhu
call System.Void S37c6vOlNUlSLi5iipx::vUZOH9M29V(S37c6vOlNUlSLi5iipx)
ldc.i4 0
ldsfld <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a} <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_7672f3f15ca84f6eabf634a22a53b5d6
ldfld System.Int32 <Module>{42664a9c-c474-4e2e-95a0-0bfd862b7a7a}::m_5838dd6965664208a0e47d004422da60
brtrue IL_0014: switch(IL_0038,IL_0198,IL_0197)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0198,IL_0197)
a5e2c4840de06638194947d9911b2f59
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
TaAjQZlcg7iXKgmcKR.EfJwilQ2fJhN1oOXAL
BhyXE0vtbUS0mdF7XC.mCj5dDFcsltIic4QkG
MyAanS0xoCBYB3bFfq.Hih4w2YG5Q9LPln9l2
jKa51tkPEP4YxbsdZn.SdjCCOooQDOaEsfB8G
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙