Malicious
Malicious

aa0296e19c5f8b372e2cc3270b9d552c

Share on LinkedIn
Print
PE Executable
MD5: aa0296e19c5f8b372e2cc3270b9d552c
Size: 800.77 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 aa0296e19c5f8b372e2cc3270b9d552c
Sha1 476e8596749392f427439c4a61acb8b157c7e7d3
Sha256 0f8976cee8d60f7c8c2826f36db4a09f30fff94effb652cabca2efda9b4c2bf2
Sha384 b1cb5d3ba1bd5e9deac446e1a8235c0d1ebeb2d312f94ddf8bcf47fee308f3de86c608261a3048cb54c9afaa639963c4
Sha512 b90104d3eb2ef866f9b31904322fe33801bb9514f163cf017fdc55e3cbcc220b07cdbb3f5cc7b1ee898521807c2dedab220901f20a7453bb9f0ddba8d883a1fb
SSDeep 12288:VucFk6zHK/hd8gTPtfS4xGD5jZ8vJ/AfMY4+n39Ar/0/ewd2O:U/hd8gRfZxGD59i/JF+nez0td
TLSH 2205BD546626DD12C5EA42B2C8D1D1FF06B15D87E812F247A9C93EAF3A36790F7842C3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
aa0296e19c5f8b372e2cc3270b9d552c
Malicious
.Net Resources
XWe.IWu.resources
$this.Icon
[NBF]root.IconData
YWmn.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
TeaEstate.Properties.Resources.resources
Pol
[NBF]root.Data
ZZxJ
[NBF]root.Data
[NBF]root.Data-preview.png
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
YWmn.exe
Full Name
YWmn.exe
EntryPoint
System.Void i9.WE::tx()
Scope Name
YWmn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YWmn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void i9.WE::tx()
Main IL Instruction Count
43
Main IL 
br IL_00A0: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_004C: newobj System.Void RW5.FWZ::.ctor()
nop <null>
call System.Void i9.WE::MT()
br IL_0067: nop
call System.Void YCw.ECd::dVh()
br IL_0017: nop
nop <null>
ret <null>
newobj System.Void uHa.aHx::.ctor()
stsfld uHa.aHx i9.WE::s8
br IL_00AB: newobj System.Void TNn.KNg::.ctor()
ldsfld TNn.KNg i9.WE::wi
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_002C: nop
newobj System.Void RW5.FWZ::.ctor()
stsfld RW5.FWZ i9.WE::uj
br IL_002E: newobj System.Void uHa.aHx::.ctor()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0022: call System.Void YCw.ECd::dVh()
nop <null>
newobj System.Void mS2.ySf::.ctor()
stsfld mS2.ySf i9.WE::wD
br IL_0077: newobj System.Void XWe.IWu::.ctor()
newobj System.Void XWe.IWu::.ctor()
stsfld XWe.IWu i9.WE::pt
ldc.i4 0
ldsfld <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42} <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42}::m_523aeedb0bef4b69b0b5df30212272b5
ldfld System.Int32 <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42}::m_c32d6d5d0daf40bb831b87121dc0285a
brtrue IL_0009: switch(IL_004C)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_004C)
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_005B: nop
newobj System.Void TNn.KNg::.ctor()
stsfld TNn.KNg i9.WE::wi
br IL_003D: ldsfld TNn.KNg i9.WE::wi
Info
PE Detect: PeReader OK (file layout)
Module Name
YWmn.exe
Full Name
YWmn.exe
EntryPoint
System.Void i9.WE::tx()
Scope Name
YWmn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
YWmn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
432
Main Method
System.Void i9.WE::tx()
Main IL Instruction Count
43
Main IL 
br IL_00A0: nop
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_004C: newobj System.Void RW5.FWZ::.ctor()
nop <null>
call System.Void i9.WE::MT()
br IL_0067: nop
call System.Void YCw.ECd::dVh()
br IL_0017: nop
nop <null>
ret <null>
newobj System.Void uHa.aHx::.ctor()
stsfld uHa.aHx i9.WE::s8
br IL_00AB: newobj System.Void TNn.KNg::.ctor()
ldsfld TNn.KNg i9.WE::wi
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_002C: nop
newobj System.Void RW5.FWZ::.ctor()
stsfld RW5.FWZ i9.WE::uj
br IL_002E: newobj System.Void uHa.aHx::.ctor()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
br IL_0022: call System.Void YCw.ECd::dVh()
nop <null>
newobj System.Void mS2.ySf::.ctor()
stsfld mS2.ySf i9.WE::wD
br IL_0077: newobj System.Void XWe.IWu::.ctor()
newobj System.Void XWe.IWu::.ctor()
stsfld XWe.IWu i9.WE::pt
ldc.i4 0
ldsfld <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42} <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42}::m_523aeedb0bef4b69b0b5df30212272b5
ldfld System.Int32 <Module>{45468504-d49b-4da9-b3f1-9d00ab722a42}::m_c32d6d5d0daf40bb831b87121dc0285a
brtrue IL_0009: switch(IL_004C)
pop <null>
ldc.i4 0
br IL_0009: switch(IL_004C)
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
br IL_005B: nop
newobj System.Void TNn.KNg::.ctor()
stsfld TNn.KNg i9.WE::wi
br IL_003D: ldsfld TNn.KNg i9.WE::wi
An error has occurred. This application may no longer respond until reloaded. Reload 🗙