Malicious
Malicious

ab25a24a14ff2a8cddbd14de2a79cdbc

Share on LinkedIn
Print
PE Executable
MD5: ab25a24a14ff2a8cddbd14de2a79cdbc
Size: 583.68 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 570 KB PE Executable classified as malicious by Malva.RE. Static analysis extracted 6 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
fe3e1e95538d6e7388280be18f66a563cd0096e27bfd33501dbae06c2b6c3148
MD5
ab25a24a14ff2a8cddbd14de2a79cdbc
Verdict
Malicious
File type
PE Executable · 570 KB

Cite this report: https://app.malva.re/sha256/fe3e1e95538d6e7388280be18f66a563cd0096e27bfd33501dbae06c2b6c3148

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
583.68 KB · 583,680 B
Hashes
MD5 ab25a24a14ff2a8cddbd14de2a79cdbc Sha1 5757cde5fe0ae4e2838b6832f913d52a7dcc0322 Sha256 fe3e1e95538d6e7388280be18f66a563cd0096e27bfd33501dbae06c2b6c3148 Sha384 8e76894b2e2801de9f9faf64f409a52387f6bfbcf49cc52fe393fdce75aac6424c43878d530698e227d6c8f0b3ce435d Sha512 e4268169c24f29360558fcc2cc7a02709645b8dc802a4be970cc3eb97074d818ca8be116ba6f33adb9fddf3f57610b569c8b0f829baaa40fc7fc9b07e058a43d SSDeep 12288:yCnr3/FXQAPAM6wPCNnDc3vBu4gH1ABTqA:JDFNoM6uCxIZlB TLSH E9C49E1B37914E22C2894777D1EB5200C3E695833ABBE32F358613DA190A3FEDA16757
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 7 files
EXEab25a24a14ff2a8cddbd14de2a79cdbc
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Module Name
Avrmniuk.exe
Full Name
Avrmniuk.exe
EntryPoint
System.Void zLHYKb5ogCMhrpWPdY.UIxT0eeHpiTNePyq0S::m3WbsZSVg()
Scope Name
Avrmniuk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Avrmniuk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void zLHYKb5ogCMhrpWPdY.UIxT0eeHpiTNePyq0S::m3WbsZSVg()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0039: ldsfld ryEbWeeCQ0YoKpMTciS ryEbWeeCQ0YoKpMTciS::ybee8seC3x
ret <null>
ldsfld ryEbWeeCQ0YoKpMTciS ryEbWeeCQ0YoKpMTciS::ybee8seC3x
call System.Void ryEbWeeCQ0YoKpMTciS::aypej8QOPq(ryEbWeeCQ0YoKpMTciS)
ldc.i4 0
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_23c6c3f01f934e9892d25ae2aef4ba1c
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld ixGKDLeMiNOa5c1ca5A ixGKDLeMiNOa5c1ca5A::EvweoBLSFg
call System.Byte[] ixGKDLeMiNOa5c1ca5A::aypej8QOPq(ixGKDLeMiNOa5c1ca5A)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_f7b60c5e600541bdae0c4e35d05470a2
brtrue IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_013B)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_013B: leave IL_0038
ldc.i4 -968288257
ldc.i4 -1788583614
xor <null>
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_7a9919934d5d49d5a9f4bf9c10a1e176
xor <null>
ldsfld XRWJ0ZeKfepOVVchVio XRWJ0ZeKfepOVVchVio::gWCehBwep4
call System.String XRWJ0ZeKfepOVVchVio::aypej8QOPq(System.Int32,XRWJ0ZeKfepOVVchVio)
ldc.i4 1308006060
ldc.i4 74256545
add <null>
ldc.i4 1253706053
xor <null>
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_69f5e5cbfe9f4306800e4f7c6bfdc693
xor <null>
ldsfld XRWJ0ZeKfepOVVchVio XRWJ0ZeKfepOVVchVio::gWCehBwep4
call System.String XRWJ0ZeKfepOVVchVio::aypej8QOPq(System.Int32,XRWJ0ZeKfepOVVchVio)
newobj System.Void ESWSVw2jPU2eJj6W5j.N6cuN0NGXtmmIHhvCd::.ctor(System.String,System.String)
newobj System.Void tMWWA6ZWlXjg9opbAJ1.tVOGgHZHcp8kxtq6EPn::.ctor(ESWSVw2jPU2eJj6W5j.N6cuN0NGXtmmIHhvCd)
ldloc.s V_3
ldsfld TZJl44eRWBiSQnsMxyy TZJl44eRWBiSQnsMxyy::z0pe7Wck4q
call System.Void TZJl44eRWBiSQnsMxyy::aypej8QOPq(System.Object,System.Byte[],TZJl44eRWBiSQnsMxyy)
ldc.i4 4
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_d26568d6c029430abe038016e08315c0
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_013B)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_aaae250f68e0417eb79223082a124fee
brfalse IL_0172: switch(IL_018E)
pop <null>
ldc.i4 0
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_016E: ldloc V_0
br IL_018E: leave IL_0038
leave IL_0038: ret
ldc.i4 6
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_f5b1428761074331a856ba7ad0779a29
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Avrmniuk.exe
Full Name
Avrmniuk.exe
EntryPoint
System.Void zLHYKb5ogCMhrpWPdY.UIxT0eeHpiTNePyq0S::m3WbsZSVg()
Scope Name
Avrmniuk.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Avrmniuk
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void zLHYKb5ogCMhrpWPdY.UIxT0eeHpiTNePyq0S::m3WbsZSVg()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0039: ldsfld ryEbWeeCQ0YoKpMTciS ryEbWeeCQ0YoKpMTciS::ybee8seC3x
ret <null>
ldsfld ryEbWeeCQ0YoKpMTciS ryEbWeeCQ0YoKpMTciS::ybee8seC3x
call System.Void ryEbWeeCQ0YoKpMTciS::aypej8QOPq(ryEbWeeCQ0YoKpMTciS)
ldc.i4 0
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_23c6c3f01f934e9892d25ae2aef4ba1c
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld ixGKDLeMiNOa5c1ca5A ixGKDLeMiNOa5c1ca5A::EvweoBLSFg
call System.Byte[] ixGKDLeMiNOa5c1ca5A::aypej8QOPq(ixGKDLeMiNOa5c1ca5A)
stloc.s V_3
ldc.i4 3
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_f7b60c5e600541bdae0c4e35d05470a2
brtrue IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_013B)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_013B: leave IL_0038
ldc.i4 -968288257
ldc.i4 -1788583614
xor <null>
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_7a9919934d5d49d5a9f4bf9c10a1e176
xor <null>
ldsfld XRWJ0ZeKfepOVVchVio XRWJ0ZeKfepOVVchVio::gWCehBwep4
call System.String XRWJ0ZeKfepOVVchVio::aypej8QOPq(System.Int32,XRWJ0ZeKfepOVVchVio)
ldc.i4 1308006060
ldc.i4 74256545
add <null>
ldc.i4 1253706053
xor <null>
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_69f5e5cbfe9f4306800e4f7c6bfdc693
xor <null>
ldsfld XRWJ0ZeKfepOVVchVio XRWJ0ZeKfepOVVchVio::gWCehBwep4
call System.String XRWJ0ZeKfepOVVchVio::aypej8QOPq(System.Int32,XRWJ0ZeKfepOVVchVio)
newobj System.Void ESWSVw2jPU2eJj6W5j.N6cuN0NGXtmmIHhvCd::.ctor(System.String,System.String)
newobj System.Void tMWWA6ZWlXjg9opbAJ1.tVOGgHZHcp8kxtq6EPn::.ctor(ESWSVw2jPU2eJj6W5j.N6cuN0NGXtmmIHhvCd)
ldloc.s V_3
ldsfld TZJl44eRWBiSQnsMxyy TZJl44eRWBiSQnsMxyy::z0pe7Wck4q
call System.Void TZJl44eRWBiSQnsMxyy::aypej8QOPq(System.Object,System.Byte[],TZJl44eRWBiSQnsMxyy)
ldc.i4 4
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_d26568d6c029430abe038016e08315c0
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_013B)
leave IL_0038: ret
pop <null>
ldc.i4 4
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_aaae250f68e0417eb79223082a124fee
brfalse IL_0172: switch(IL_018E)
pop <null>
ldc.i4 0
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_016E: ldloc V_0
br IL_018E: leave IL_0038
leave IL_0038: ret
ldc.i4 6
ldsfld <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000} <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_e3b606b2a8a84040bdf25ab7b58369b2
ldfld System.Int32 <Module>{f37f1125-eb2e-4b19-b068-6f01465a9000}::m_f5b1428761074331a856ba7ad0779a29
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)

An error has occurred. This application may no longer respond until reloaded. Reload 🗙