Malicious
Malicious

acfb95db0d53219b6390f0973e2dce63

Share on LinkedIn
Print
PE Executable
MD5: acfb95db0d53219b6390f0973e2dce63
Size: 429.06 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 acfb95db0d53219b6390f0973e2dce63
Sha1 265723d7b7bd7889a171ff831f5be0246e032b3e
Sha256 6c3290de54b94a0df32b50a045ea0f90380c7b57bd8992f6a71cca6b1ad2574f
Sha384 25816dc29c1377dae1ca330548442a5001a41352f0dcf050ed07a8f387d53837dd1246aaeadcecca8e3047992381a8d8
Sha512 0066d786553076ec2f114b2c31c8a08414fb899fa70aad35413f50d86c36ea6f9b1ff58e39179492aa8064bcb904ed6ab0430081fb0580b3dd9c78a398050d22
SSDeep 6144:JFNmvsvzfOjh5kdoPKpc4onx4PidMt8LtSmJmh7d:JF2svzChiQxA6SmE7
TLSH A5943A3B72958F21C2855373C2CF495087EA964736ABFB0B368913D719023EEDA066D7
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
acfb95db0d53219b6390f0973e2dce63
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ywxi2Firuslls9qOgC.LujkN6Fr85M5ciEfB3
56g4NYXLfKs2rWOBgA.em4Ay7jrXoxRfQ2tdj
ZdnZZPmA70yfqKFuB8.upuOVyUVFx5YGbXXxu
fLqJJbgLVnQ3eRcbN6.PJ6a7aN8aOrhCWxEAj
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Pivigjrwf.exe
Full Name
Pivigjrwf.exe
EntryPoint
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Scope Name
Pivigjrwf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pivigjrwf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ret
nop <null>
ldsfld y8ypgAdiwYd6KE8p3FI y8ypgAdiwYd6KE8p3FI::jfAdFA56r6
call System.Byte[] y8ypgAdiwYd6KE8p3FI::Qqed1YtIyO(y8ypgAdiwYd6KE8p3FI)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1dd103049569436f82d91483de9769d5
brtrue IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_011B)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 808829452
ldc.i4 808829452
neg <null>
ldc.i4 -1747226738
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_71cbec4717104a9abfafc9f3029fbd65
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
ldc.i4 762495861
ldc.i4 1998164170
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
newobj System.Void OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld BtWidsdCRdFUrUP7Fwj BtWidsdCRdFUrUP7Fwj::yFQdlYU2G7
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh BtWidsdCRdFUrUP7Fwj::Qqed1YtIyO(System.Object,System.Byte[],BtWidsdCRdFUrUP7Fwj)
ldsfld lEVGqCd4DXJyeqOUBT0 lEVGqCd4DXJyeqOUBT0::FmmdkAw0AE
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh lEVGqCd4DXJyeqOUBT0::Qqed1YtIyO(System.Object,lEVGqCd4DXJyeqOUBT0)
ldsfld UlA0fAdaT3venRZohZJ UlA0fAdaT3venRZohZJ::r6UdrDpZHJ
call System.Void UlA0fAdaT3venRZohZJ::Qqed1YtIyO(System.Object,UlA0fAdaT3venRZohZJ)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_a7a2579862aa4c10a046f9a76cbce626
brfalse IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0096,IL_011B)
leave IL_0192: ret
pop <null>
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_adfeb66aac22491292cad9a955fc280e
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 5
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014E: ldloc V_0
br IL_016E: leave IL_0192
leave IL_0192: ret
ldc.i4 5
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_ff9a8fef5cd54bef9432831fbcf387b8
brfalse IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
ret <null>
ldsfld iEU6EKdXcdHYIG5qxGd iEU6EKdXcdHYIG5qxGd::NwNdj3BcuS
call System.Void iEU6EKdXcdHYIG5qxGd::Qqed1YtIyO(iEU6EKdXcdHYIG5qxGd)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
brtrue IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
Module Name
Pivigjrwf.exe
Full Name
Pivigjrwf.exe
EntryPoint
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Scope Name
Pivigjrwf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pivigjrwf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void VQUOECKEn3sQX2yj8B.lHk2SkdqwqcsXfKMDr::IKiCYYS8h()
Main IL Instruction Count
98
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0192: ret
nop <null>
ldsfld y8ypgAdiwYd6KE8p3FI y8ypgAdiwYd6KE8p3FI::jfAdFA56r6
call System.Byte[] y8ypgAdiwYd6KE8p3FI::Qqed1YtIyO(y8ypgAdiwYd6KE8p3FI)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1dd103049569436f82d91483de9769d5
brtrue IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 0
br IL_0076: switch(IL_0096,IL_011B)
br IL_0072: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0072: ldloc V_3
br IL_0096: ldc.i4 808829452
ldc.i4 808829452
neg <null>
ldc.i4 -1747226738
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_71cbec4717104a9abfafc9f3029fbd65
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
ldc.i4 762495861
ldc.i4 1998164170
xor <null>
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
xor <null>
ldsfld yjAeuDddJC177gU1Sb7 yjAeuDddJC177gU1Sb7::y5PdKIj5yH
call System.String yjAeuDddJC177gU1Sb7::Qqed1YtIyO(System.Int32,yjAeuDddJC177gU1Sb7)
newobj System.Void OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld BtWidsdCRdFUrUP7Fwj BtWidsdCRdFUrUP7Fwj::yFQdlYU2G7
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh BtWidsdCRdFUrUP7Fwj::Qqed1YtIyO(System.Object,System.Byte[],BtWidsdCRdFUrUP7Fwj)
ldsfld lEVGqCd4DXJyeqOUBT0 lEVGqCd4DXJyeqOUBT0::FmmdkAw0AE
call OX7aEggY73T9CxV1VkY.EYm0G8g1fGUZ3ygwCAh lEVGqCd4DXJyeqOUBT0::Qqed1YtIyO(System.Object,lEVGqCd4DXJyeqOUBT0)
ldsfld UlA0fAdaT3venRZohZJ UlA0fAdaT3venRZohZJ::r6UdrDpZHJ
call System.Void UlA0fAdaT3venRZohZJ::Qqed1YtIyO(System.Object,UlA0fAdaT3venRZohZJ)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_a7a2579862aa4c10a046f9a76cbce626
brfalse IL_0076: switch(IL_0096,IL_011B)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0096,IL_011B)
leave IL_0192: ret
pop <null>
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_adfeb66aac22491292cad9a955fc280e
brtrue IL_0152: switch(IL_016E)
pop <null>
ldc.i4 5
br IL_0152: switch(IL_016E)
br IL_014E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_014E: ldloc V_0
br IL_016E: leave IL_0192
leave IL_0192: ret
ldc.i4 5
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_ff9a8fef5cd54bef9432831fbcf387b8
brfalse IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
ret <null>
ldsfld iEU6EKdXcdHYIG5qxGd iEU6EKdXcdHYIG5qxGd::NwNdj3BcuS
call System.Void iEU6EKdXcdHYIG5qxGd::Qqed1YtIyO(iEU6EKdXcdHYIG5qxGd)
ldc.i4 0
ldsfld <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673} <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_1de87e99271647b39e2188cdab69794e
ldfld System.Int32 <Module>{eb1f6416-e52a-41f4-84da-03a24dab4673}::m_16aec56e7b794cdbba07fa35a0314781
brtrue IL_0014: switch(IL_0038,IL_0193,IL_0192)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0038,IL_0193,IL_0192)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙