Malicious
Malicious

a997495adfe07c488e3d89c0667f8df3

PE Executable
MD5: a997495adfe07c488e3d89c0667f8df3
Size: 421.38 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a997495adfe07c488e3d89c0667f8df3
Sha1 018e28dbb2a4e09b346d7161214afff7b0c83a2c
Sha256 f626335064988d1687d5bc75faee7a1ff782c84efb62ae539ca2b7a0809df3fd
Sha384 ee03866127df70d250651f233abc35c0ce946aa712113a81912132d0cf57d9c8a289fe9e97f09a9a8c079fac67c822f4
Sha512 bb25a52d8e03e7d193171526d19ce08756317066c16537dbb54290f2d2d3eb649e44702e131055ab84e2a5a73dea75d108c0d41f71537244ee99aebfbef151cb
SSDeep 6144:WB618+Hic40oesmFzkSnHKB2surGf22rxmu6sWGd0VJohw:Y6HCHJwzfdPGu2Nmu6sWS0bohw
TLSH F694392A72D58E22C24A4372C1C7490097A6DA47A6ABFB0B35C413D61D433FEDE4B797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a997495adfe07c488e3d89c0667f8df3
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uYN5GCGgIUJo944sll.iWrGJifH8l0h6LlkDe
HBc7SmUDFFBpmQy0Qx.Kh869mATh3e1iFlqIA
rRag2y9CV737SH0ZR0.sPP2eepPXA5TjiammA
HBTlbrmnLJaGhuyYFm.4TD3x3xdESqhmbyNtU
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nkxtr.exe
Full Name
Nkxtr.exe
EntryPoint
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Scope Name
Nkxtr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nkxtr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: nop
nop <null>
ldsfld I1LpK1u9YJ1tOcyESbf I1LpK1u9YJ1tOcyESbf::FWOupPRtYV
call System.Byte[] I1LpK1u9YJ1tOcyESbf::AEEuNnu2eA(I1LpK1u9YJ1tOcyESbf)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 -926094787
ldc.i4 -927799646
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_76f0a57689e3482e8b610a49d759ced7
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
ldc.i4 -975858044
ldc.i4 -886159290
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_8c05e7fccfd145859e5db863387b151c
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
newobj System.Void KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NBVKLeu7TFT00F3Oy3q NBVKLeu7TFT00F3Oy3q::UBfu5yS8LY
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub NBVKLeu7TFT00F3Oy3q::AEEuNnu2eA(System.Object,System.Byte[],NBVKLeu7TFT00F3Oy3q)
ldsfld SA9s2CuBmTlbjsPfVmt SA9s2CuBmTlbjsPfVmt::QPduKluJLB
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub SA9s2CuBmTlbjsPfVmt::AEEuNnu2eA(System.Object,SA9s2CuBmTlbjsPfVmt)
ldsfld mqxbf3uIV8naLWkBO5C mqxbf3uIV8naLWkBO5C::tnkuqlykZh
call System.Void mqxbf3uIV8naLWkBO5C::AEEuNnu2eA(System.Object,mqxbf3uIV8naLWkBO5C)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_9f38eedd4d6c4a9eb2efd69263107795
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 5
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014D: ldloc V_2
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_075999fbc89447c689c4f6a0d5895ee3
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld QSb1SbuUTrS6Ix2H8w8 QSb1SbuUTrS6Ix2H8w8::UHruAECcQb
call System.Void QSb1SbuUTrS6Ix2H8w8::AEEuNnu2eA(QSb1SbuUTrS6Ix2H8w8)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_92125ca04e1d4e549681604f86c73cab
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
Module Name
Nkxtr.exe
Full Name
Nkxtr.exe
EntryPoint
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Scope Name
Nkxtr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nkxtr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: nop
nop <null>
ldsfld I1LpK1u9YJ1tOcyESbf I1LpK1u9YJ1tOcyESbf::FWOupPRtYV
call System.Byte[] I1LpK1u9YJ1tOcyESbf::AEEuNnu2eA(I1LpK1u9YJ1tOcyESbf)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 -926094787
ldc.i4 -927799646
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_76f0a57689e3482e8b610a49d759ced7
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
ldc.i4 -975858044
ldc.i4 -886159290
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_8c05e7fccfd145859e5db863387b151c
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
newobj System.Void KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NBVKLeu7TFT00F3Oy3q NBVKLeu7TFT00F3Oy3q::UBfu5yS8LY
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub NBVKLeu7TFT00F3Oy3q::AEEuNnu2eA(System.Object,System.Byte[],NBVKLeu7TFT00F3Oy3q)
ldsfld SA9s2CuBmTlbjsPfVmt SA9s2CuBmTlbjsPfVmt::QPduKluJLB
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub SA9s2CuBmTlbjsPfVmt::AEEuNnu2eA(System.Object,SA9s2CuBmTlbjsPfVmt)
ldsfld mqxbf3uIV8naLWkBO5C mqxbf3uIV8naLWkBO5C::tnkuqlykZh
call System.Void mqxbf3uIV8naLWkBO5C::AEEuNnu2eA(System.Object,mqxbf3uIV8naLWkBO5C)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_9f38eedd4d6c4a9eb2efd69263107795
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 5
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014D: ldloc V_2
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_075999fbc89447c689c4f6a0d5895ee3
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld QSb1SbuUTrS6Ix2H8w8 QSb1SbuUTrS6Ix2H8w8::UHruAECcQb
call System.Void QSb1SbuUTrS6Ix2H8w8::AEEuNnu2eA(QSb1SbuUTrS6Ix2H8w8)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_92125ca04e1d4e549681604f86c73cab
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
a997495adfe07c488e3d89c0667f8df3
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uYN5GCGgIUJo944sll.iWrGJifH8l0h6LlkDe
HBc7SmUDFFBpmQy0Qx.Kh869mATh3e1iFlqIA
rRag2y9CV737SH0ZR0.sPP2eepPXA5TjiammA
HBTlbrmnLJaGhuyYFm.4TD3x3xdESqhmbyNtU
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙