aa1f909475f13c068cee203dac140b73

PE Executable

MD5: aa1f909475f13c068cee203dac140b73

Size: 1.23 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	aa1f909475f13c068cee203dac140b73
Sha1	0794d88a0631d8a9a80f2d6ba5d579a49f312322
Sha256	ecd1a3f02c5a6cabd46a516599bc177ecd29af75099c50fa9bd3bf026507dcb8
Sha384	22a700483afb0e8addc2577510c92e643ff4593fe822174d40d957e8bcec0e9f22c8876e7be8dc87b3506fd040f7df4c
Sha512	68296ab43ed9f685f4502ea1fb4e5cd319570cc6de248e554eb6c16dadec6e3e39989e52f7194492754629d04ae6674cf136edbdbea8fda225d2a5b7c6f790e6
SSDeep	24576:4+Zgqj0qdPJ1AhLcf8JssJTEPPEOikwv+5kqqvPRV+vW0WkLmieeXxqFx:X/CK1ATsPav+dOPRVevL5x0x
TLSH	A64501546327E412CA1593314AE2E1B407B94EDAF453D7676FE87EDB7A29F090E80383

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

5 / 5

Path pe:exe>img>img

Shape pe:exe>img>img

malicious 3 nodes

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Name	Value
Module Name	qVEi.exe
Full Name	qVEi.exe
EntryPoint	System.Void WaD.oa0::caB()
Scope Name	qVEi.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	qVEi
Assembly Version	5.3.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Info	PE Detect: PeReader OK (file layout)
Total Strings	434
Main Method	System.Void WaD.oa0::caB()
Main IL Instruction Count	12
Main IL	br IL_0010: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ret <null> call System.Void Ae1.feS::huL() br IL_0025: newobj System.Void A8c.N8C::.ctor() call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001A: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0006: call System.Void Ae1.feS::huL() newobj System.Void A8c.N8C::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: ret
Info	PDB Path: qVEi.pdb
Module Name	qVEi.exe
Full Name	qVEi.exe
EntryPoint	System.Void WaD.oa0::caB()
Scope Name	qVEi.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	qVEi
Assembly Version	5.3.7.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	434
Main Method	System.Void WaD.oa0::caB()
Main IL Instruction Count	12
Main IL	br IL_0010: call System.Void System.Windows.Forms.Application::EnableVisualStyles() ret <null> call System.Void Ae1.feS::huL() br IL_0025: newobj System.Void A8c.N8C::.ctor() call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_001A: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0006: call System.Void Ae1.feS::huL() newobj System.Void A8c.N8C::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0005: ret

No malware configuration was found at this point.

You must be signed in to view YARA rules.