Malicious
Malicious

acfb95db0d53219b6390f0973e2dce63

PE Executable
MD5: acfb95db0d53219b6390f0973e2dce63
Size: 429.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 acfb95db0d53219b6390f0973e2dce63
Sha1 265723d7b7bd7889a171ff831f5be0246e032b3e
Sha256 6c3290de54b94a0df32b50a045ea0f90380c7b57bd8992f6a71cca6b1ad2574f
Sha384 25816dc29c1377dae1ca330548442a5001a41352f0dcf050ed07a8f387d53837dd1246aaeadcecca8e3047992381a8d8
Sha512 0066d786553076ec2f114b2c31c8a08414fb899fa70aad35413f50d86c36ea6f9b1ff58e39179492aa8064bcb904ed6ab0430081fb0580b3dd9c78a398050d22
SSDeep 6144:JFNmvsvzfOjh5kdoPKpc4onx4PidMt8LtSmJmh7d:JF2svzChiQxA6SmE7
TLSH A5943A3B72958F21C2855373C2CF495087EA964736ABFB0B368913D719023EEDA066D7
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
acfb95db0d53219b6390f0973e2dce63
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ywxi2Firuslls9qOgC.LujkN6Fr85M5ciEfB3
56g4NYXLfKs2rWOBgA.em4Ay7jrXoxRfQ2tdj
ZdnZZPmA70yfqKFuB8.upuOVyUVFx5YGbXXxu
fLqJJbgLVnQ3eRcbN6.PJ6a7aN8aOrhCWxEAj
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Pivigjrwf.exe
Full Name
Pivigjrwf.exe
EntryPoint
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Scope Name
Pivigjrwf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pivigjrwf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ret
nop <null>
ldsfld y8ypgAdiwYd6KE8p3FI y8ypgAdiwYd6KE8p3FI::jfAdFA56r6
call System.Byte[] y8ypgAdiwYd6KE8p3FI::Qqed1YtIyO(y8ypgAdiwYd6KE8p3FI)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1dd103049569436f82d91483de9769d5
brtrue IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_011B)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 808829452
ldc.i4 808829452
neg <null>
ldc.i4 -1747226738
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_71cbec4717104a9abfafc9f3029fbd65
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
ldc.i4 762495861
ldc.i4 1998164170
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
newobj System.Void OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld BtWidsdCRdFUrUP7Fwj BtWidsdCRdFUrUP7Fwj::yFQdlYU2G7
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh BtWidsdCRdFUrUP7Fwj::Qqed1YtIyO(System.Object,System.Byte[],BtWidsdCRdFUrUP7Fwj)
ldsfld lEVGqCd4DXJyeqOUBT0 lEVGqCd4DXJyeqOUBT0::FmmdkAw0AE
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh lEVGqCd4DXJyeqOUBT0::Qqed1YtIyO(System.Object,lEVGqCd4DXJyeqOUBT0)
ldsfld UlA0fAdaT3venRZohZJ UlA0fAdaT3venRZohZJ::r6UdrDpZHJ
call System.Void UlA0fAdaT3venRZohZJ::Qqed1YtIyO(System.Object,UlA0fAdaT3venRZohZJ)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_a7a2579862aa4c10a046f9a76cbce626
brfalse IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0096,IL_011B)
leave IL_0192: ret
pop <null>
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_adfeb66aac22491292cad9a955fc280e
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 5
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014E: ldloc V_0
br IL_016E: leave IL_0192
leave IL_0192: ret
ldc.i4 5
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_ff9a8fef5cd54bef9432831fbcf387b8
brfalse IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
ret <null>
ldsfld iEU6EKdXcdHYIG5qxGd iEU6EKdXcdHYIG5qxGd::NwNdj3BcuS
call System.Void iEU6EKdXcdHYIG5qxGd::Qqed1YtIyO(iEU6EKdXcdHYIG5qxGd)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
brtrue IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
Module Name
Pivigjrwf.exe
Full Name
Pivigjrwf.exe
EntryPoint
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Scope Name
Pivigjrwf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pivigjrwf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ret
nop <null>
ldsfld y8ypgAdiwYd6KE8p3FI y8ypgAdiwYd6KE8p3FI::jfAdFA56r6
call System.Byte[] y8ypgAdiwYd6KE8p3FI::Qqed1YtIyO(y8ypgAdiwYd6KE8p3FI)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1dd103049569436f82d91483de9769d5
brtrue IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_011B)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 808829452
ldc.i4 808829452
neg <null>
ldc.i4 -1747226738
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_71cbec4717104a9abfafc9f3029fbd65
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
ldc.i4 762495861
ldc.i4 1998164170
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
newobj System.Void OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld BtWidsdCRdFUrUP7Fwj BtWidsdCRdFUrUP7Fwj::yFQdlYU2G7
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh BtWidsdCRdFUrUP7Fwj::Qqed1YtIyO(System.Object,System.Byte[],BtWidsdCRdFUrUP7Fwj)
ldsfld lEVGqCd4DXJyeqOUBT0 lEVGqCd4DXJyeqOUBT0::FmmdkAw0AE
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh lEVGqCd4DXJyeqOUBT0::Qqed1YtIyO(System.Object,lEVGqCd4DXJyeqOUBT0)
ldsfld UlA0fAdaT3venRZohZJ UlA0fAdaT3venRZohZJ::r6UdrDpZHJ
call System.Void UlA0fAdaT3venRZohZJ::Qqed1YtIyO(System.Object,UlA0fAdaT3venRZohZJ)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_a7a2579862aa4c10a046f9a76cbce626
brfalse IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0096,IL_011B)
leave IL_0192: ret
pop <null>
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_adfeb66aac22491292cad9a955fc280e
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 5
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014E: ldloc V_0
br IL_016E: leave IL_0192
leave IL_0192: ret
ldc.i4 5
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_ff9a8fef5cd54bef9432831fbcf387b8
brfalse IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
ret <null>
ldsfld iEU6EKdXcdHYIG5qxGd iEU6EKdXcdHYIG5qxGd::NwNdj3BcuS
call System.Void iEU6EKdXcdHYIG5qxGd::Qqed1YtIyO(iEU6EKdXcdHYIG5qxGd)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
brtrue IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
acfb95db0d53219b6390f0973e2dce63
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ywxi2Firuslls9qOgC.LujkN6Fr85M5ciEfB3
56g4NYXLfKs2rWOBgA.em4Ay7jrXoxRfQ2tdj
ZdnZZPmA70yfqKFuB8.upuOVyUVFx5YGbXXxu
fLqJJbgLVnQ3eRcbN6.PJ6a7aN8aOrhCWxEAj
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙