Malicious
Malicious

a997495adfe07c488e3d89c0667f8df3

Share on LinkedIn
Print
PE Executable
MD5: a997495adfe07c488e3d89c0667f8df3
Size: 421.38 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a997495adfe07c488e3d89c0667f8df3
Sha1 018e28dbb2a4e09b346d7161214afff7b0c83a2c
Sha256 f626335064988d1687d5bc75faee7a1ff782c84efb62ae539ca2b7a0809df3fd
Sha384 ee03866127df70d250651f233abc35c0ce946aa712113a81912132d0cf57d9c8a289fe9e97f09a9a8c079fac67c822f4
Sha512 bb25a52d8e03e7d193171526d19ce08756317066c16537dbb54290f2d2d3eb649e44702e131055ab84e2a5a73dea75d108c0d41f71537244ee99aebfbef151cb
SSDeep 6144:WB618+Hic40oesmFzkSnHKB2surGf22rxmu6sWGd0VJohw:Y6HCHJwzfdPGu2Nmu6sWS0bohw
TLSH F694392A72D58E22C24A4372C1C7490097A6DA47A6ABFB0B35C413D61D433FEDE4B797
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a997495adfe07c488e3d89c0667f8df3
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
uYN5GCGgIUJo944sll.iWrGJifH8l0h6LlkDe
HBc7SmUDFFBpmQy0Qx.Kh869mATh3e1iFlqIA
rRag2y9CV737SH0ZR0.sPP2eepPXA5TjiammA
HBTlbrmnLJaGhuyYFm.4TD3x3xdESqhmbyNtU
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Nkxtr.exe
Full Name
Nkxtr.exe
EntryPoint
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Scope Name
Nkxtr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nkxtr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: nop
nop <null>
ldsfld I1LpK1u9YJ1tOcyESbf I1LpK1u9YJ1tOcyESbf::FWOupPRtYV
call System.Byte[] I1LpK1u9YJ1tOcyESbf::AEEuNnu2eA(I1LpK1u9YJ1tOcyESbf)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 -926094787
ldc.i4 -927799646
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_76f0a57689e3482e8b610a49d759ced7
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
ldc.i4 -975858044
ldc.i4 -886159290
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_8c05e7fccfd145859e5db863387b151c
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
newobj System.Void KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NBVKLeu7TFT00F3Oy3q NBVKLeu7TFT00F3Oy3q::UBfu5yS8LY
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub NBVKLeu7TFT00F3Oy3q::AEEuNnu2eA(System.Object,System.Byte[],NBVKLeu7TFT00F3Oy3q)
ldsfld SA9s2CuBmTlbjsPfVmt SA9s2CuBmTlbjsPfVmt::QPduKluJLB
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub SA9s2CuBmTlbjsPfVmt::AEEuNnu2eA(System.Object,SA9s2CuBmTlbjsPfVmt)
ldsfld mqxbf3uIV8naLWkBO5C mqxbf3uIV8naLWkBO5C::tnkuqlykZh
call System.Void mqxbf3uIV8naLWkBO5C::AEEuNnu2eA(System.Object,mqxbf3uIV8naLWkBO5C)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_9f38eedd4d6c4a9eb2efd69263107795
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 5
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014D: ldloc V_2
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_075999fbc89447c689c4f6a0d5895ee3
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld QSb1SbuUTrS6Ix2H8w8 QSb1SbuUTrS6Ix2H8w8::UHruAECcQb
call System.Void QSb1SbuUTrS6Ix2H8w8::AEEuNnu2eA(QSb1SbuUTrS6Ix2H8w8)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_92125ca04e1d4e549681604f86c73cab
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
Module Name
Nkxtr.exe
Full Name
Nkxtr.exe
EntryPoint
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Scope Name
Nkxtr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Nkxtr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void B0sGxRYph3Eq8bQMs4.hgTxIUunXJK4JYTePE::jfg7gROSe()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0038: nop
nop <null>
ldsfld I1LpK1u9YJ1tOcyESbf I1LpK1u9YJ1tOcyESbf::FWOupPRtYV
call System.Byte[] I1LpK1u9YJ1tOcyESbf::AEEuNnu2eA(I1LpK1u9YJ1tOcyESbf)
stloc.s V_0
ldc.i4 7
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_011A,IL_0096)
br IL_0072: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0072: ldloc V_1
br IL_011A: leave IL_0191
ldc.i4 -926094787
ldc.i4 -927799646
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_76f0a57689e3482e8b610a49d759ced7
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
ldc.i4 -975858044
ldc.i4 -886159290
xor <null>
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_8c05e7fccfd145859e5db863387b151c
xor <null>
ldsfld TMxcnwuuSQCgi7fsFuB TMxcnwuuSQCgi7fsFuB::zsHuYKMMts
call System.String TMxcnwuuSQCgi7fsFuB::AEEuNnu2eA(System.Int32,TMxcnwuuSQCgi7fsFuB)
newobj System.Void KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NBVKLeu7TFT00F3Oy3q NBVKLeu7TFT00F3Oy3q::UBfu5yS8LY
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub NBVKLeu7TFT00F3Oy3q::AEEuNnu2eA(System.Object,System.Byte[],NBVKLeu7TFT00F3Oy3q)
ldsfld SA9s2CuBmTlbjsPfVmt SA9s2CuBmTlbjsPfVmt::QPduKluJLB
call KTDcx5mWl5sklIsvqJX.a5XopgmNERVjx1Nxlub SA9s2CuBmTlbjsPfVmt::AEEuNnu2eA(System.Object,SA9s2CuBmTlbjsPfVmt)
ldsfld mqxbf3uIV8naLWkBO5C mqxbf3uIV8naLWkBO5C::tnkuqlykZh
call System.Void mqxbf3uIV8naLWkBO5C::AEEuNnu2eA(System.Object,mqxbf3uIV8naLWkBO5C)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_9f38eedd4d6c4a9eb2efd69263107795
brfalse IL_0076: switch(IL_011A,IL_0096)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_011A,IL_0096)
leave IL_0191: ret
pop <null>
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_143dd78fa30f4bc49fa50ff80bea874a
brtrue IL_0151: switch(IL_016D)
pop <null>
ldc.i4 5
br IL_0151: switch(IL_016D)
br IL_014D: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_014D: ldloc V_2
br IL_016D: leave IL_0191
leave IL_0191: ret
ldc.i4 2
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_075999fbc89447c689c4f6a0d5895ee3
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
ret <null>
ldsfld QSb1SbuUTrS6Ix2H8w8 QSb1SbuUTrS6Ix2H8w8::UHruAECcQb
call System.Void QSb1SbuUTrS6Ix2H8w8::AEEuNnu2eA(QSb1SbuUTrS6Ix2H8w8)
ldc.i4 0
ldsfld <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7} <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_4521902512f644c7aac06809793422de
ldfld System.Int32 <Module>{de6742a1-d460-4df1-b5d8-27006eab3bd7}::m_92125ca04e1d4e549681604f86c73cab
brfalse IL_0014: switch(IL_0038,IL_0192,IL_0191)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0192,IL_0191)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙