Malicious
Malicious

adf8bf7394c5b1a059f9fb5c1c22515f

Share on LinkedIn
Print
PE Executable
MD5: adf8bf7394c5b1a059f9fb5c1c22515f
Size: 424.96 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
424.96 KB · 424,960 B
First seen
2026-08-19 17:00 · 2 months ago
Last seen
2026-08-19 17:00 · 2 months ago
Last analysis
2026-08-19 17:00 · 2 months ago
Hashes
MD5 adf8bf7394c5b1a059f9fb5c1c22515f Sha1 6e9cbb4f13be881370ea168891a6cbc3b4dbe47c Sha256 5d5f894ef71d10255620990abd68ba7ef14b7da956f6317375e9adbe04f2e5a5 Sha384 ce99e2eb85938aff7d0e6b57880d4cbe89830f2dd5db82bca6dde9bb32be19397253b4d1c2d716948492e7e4a19baa49 Sha512 6cfd822e184dd483cdb3d1064dd743d4127c4bba49b2184f743a4c0c0f346b8d6db06fd9d09638097e78c46f15ccd3fcda03a23e4da78b788a4b278da3eb6e95 SSDeep 6144:mAsfecamdTzES+5/yOrHFYOVhL7UYBiG+kJh6K3NcXie1Gx3U:6xdTzEk2FYOVhL720AK09cxE TLSH 0C943A2B72914F21C24A5372C1CB4A0087EA968776ABFB0F71C513D61D463FEDE4A297
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEadf8bf7394c5b1a059f9fb5c1c22515f
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Tqcbn.exe
Full Name
Tqcbn.exe
EntryPoint
System.Void ca6TM8sMEMMgUw21Ws.IN3iureyQLMZGGufIp::Jlvv8ej6l()
Scope Name
Tqcbn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tqcbn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ca6TM8sMEMMgUw21Ws.IN3iureyQLMZGGufIp::Jlvv8ej6l()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ldsfld SKU5f2eADBk7gLVk0mp SKU5f2eADBk7gLVk0mp::nrue3V5QGU
ldsfld SKU5f2eADBk7gLVk0mp SKU5f2eADBk7gLVk0mp::nrue3V5QGU
call System.Void SKU5f2eADBk7gLVk0mp::CPXeiAd9Cf(SKU5f2eADBk7gLVk0mp)
ldc.i4 0
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_2adfece2b2af40efaec4bf487f1b7156
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld oODO1aepMq75POiiP8g oODO1aepMq75POiiP8g::G1vef4SdMl
call System.Byte[] oODO1aepMq75POiiP8g::CPXeiAd9Cf(oODO1aepMq75POiiP8g)
stloc.s V_0
ldc.i4 5
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_535f0bde0b2047349d521270775a3e67
brfalse IL_009F: switch(IL_00BF,IL_0149)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0149)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0149: leave IL_01C0
ldc.i4 -927828206
ldc.i4 -1623392942
add <null>
ldc.i4 1585559083
xor <null>
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_bf486cfa3f8b4fc5b79f8ad6e5090fea
xor <null>
ldsfld rUPjPyee7xtaVJ2OYZv rUPjPyee7xtaVJ2OYZv::gfyessm1Qs
call System.String rUPjPyee7xtaVJ2OYZv::CPXeiAd9Cf(System.Int32,rUPjPyee7xtaVJ2OYZv)
ldc.i4 487446348
ldc.i4 1413519333
xor <null>
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_535f0bde0b2047349d521270775a3e67
xor <null>
ldsfld rUPjPyee7xtaVJ2OYZv rUPjPyee7xtaVJ2OYZv::gfyessm1Qs
call System.String rUPjPyee7xtaVJ2OYZv::CPXeiAd9Cf(System.Int32,rUPjPyee7xtaVJ2OYZv)
newobj System.Void l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NmCN2qevlHfjWlFQBWf NmCN2qevlHfjWlFQBWf::i51eBEqWdc
call l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3 NmCN2qevlHfjWlFQBWf::CPXeiAd9Cf(System.Object,System.Byte[],NmCN2qevlHfjWlFQBWf)
ldsfld n3TySTerXBFG0eh5lOr n3TySTerXBFG0eh5lOr::PmLeLqmX8s
call l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3 n3TySTerXBFG0eh5lOr::CPXeiAd9Cf(System.Object,n3TySTerXBFG0eh5lOr)
ldsfld fpmxDdeY5wg1odSDZQW fpmxDdeY5wg1odSDZQW::RhPe5bd3MC
call System.Void fpmxDdeY5wg1odSDZQW::CPXeiAd9Cf(System.Object,fpmxDdeY5wg1odSDZQW)
ldc.i4 5
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_913ebfafbf174187a48365dc87d3247c
brfalse IL_009F: switch(IL_00BF,IL_0149)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_00BF,IL_0149)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_5315620bff11495681d1f7f158a6f595
brfalse IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017C: ldloc V_3
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_7cbd1dc6d8e84ebeae1b05ef3776e101
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
Module Name
Tqcbn.exe
Full Name
Tqcbn.exe
EntryPoint
System.Void ca6TM8sMEMMgUw21Ws.IN3iureyQLMZGGufIp::Jlvv8ej6l()
Scope Name
Tqcbn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tqcbn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void ca6TM8sMEMMgUw21Ws.IN3iureyQLMZGGufIp::Jlvv8ej6l()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ldsfld SKU5f2eADBk7gLVk0mp SKU5f2eADBk7gLVk0mp::nrue3V5QGU
ldsfld SKU5f2eADBk7gLVk0mp SKU5f2eADBk7gLVk0mp::nrue3V5QGU
call System.Void SKU5f2eADBk7gLVk0mp::CPXeiAd9Cf(SKU5f2eADBk7gLVk0mp)
ldc.i4 0
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_2adfece2b2af40efaec4bf487f1b7156
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
nop <null>
ldsfld oODO1aepMq75POiiP8g oODO1aepMq75POiiP8g::G1vef4SdMl
call System.Byte[] oODO1aepMq75POiiP8g::CPXeiAd9Cf(oODO1aepMq75POiiP8g)
stloc.s V_0
ldc.i4 5
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_535f0bde0b2047349d521270775a3e67
brfalse IL_009F: switch(IL_00BF,IL_0149)
pop <null>
ldc.i4 0
br IL_009F: switch(IL_00BF,IL_0149)
br IL_009B: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009B: ldloc V_1
br IL_0149: leave IL_01C0
ldc.i4 -927828206
ldc.i4 -1623392942
add <null>
ldc.i4 1585559083
xor <null>
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_bf486cfa3f8b4fc5b79f8ad6e5090fea
xor <null>
ldsfld rUPjPyee7xtaVJ2OYZv rUPjPyee7xtaVJ2OYZv::gfyessm1Qs
call System.String rUPjPyee7xtaVJ2OYZv::CPXeiAd9Cf(System.Int32,rUPjPyee7xtaVJ2OYZv)
ldc.i4 487446348
ldc.i4 1413519333
xor <null>
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_535f0bde0b2047349d521270775a3e67
xor <null>
ldsfld rUPjPyee7xtaVJ2OYZv rUPjPyee7xtaVJ2OYZv::gfyessm1Qs
call System.String rUPjPyee7xtaVJ2OYZv::CPXeiAd9Cf(System.Int32,rUPjPyee7xtaVJ2OYZv)
newobj System.Void l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld NmCN2qevlHfjWlFQBWf NmCN2qevlHfjWlFQBWf::i51eBEqWdc
call l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3 NmCN2qevlHfjWlFQBWf::CPXeiAd9Cf(System.Object,System.Byte[],NmCN2qevlHfjWlFQBWf)
ldsfld n3TySTerXBFG0eh5lOr n3TySTerXBFG0eh5lOr::PmLeLqmX8s
call l4nkQvqnrts75mP3QBR.aFcPnVqi17JA9CKIJR3 n3TySTerXBFG0eh5lOr::CPXeiAd9Cf(System.Object,n3TySTerXBFG0eh5lOr)
ldsfld fpmxDdeY5wg1odSDZQW fpmxDdeY5wg1odSDZQW::RhPe5bd3MC
call System.Void fpmxDdeY5wg1odSDZQW::CPXeiAd9Cf(System.Object,fpmxDdeY5wg1odSDZQW)
ldc.i4 5
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_913ebfafbf174187a48365dc87d3247c
brfalse IL_009F: switch(IL_00BF,IL_0149)
pop <null>
ldc.i4 1
br IL_009F: switch(IL_00BF,IL_0149)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_5315620bff11495681d1f7f158a6f595
brfalse IL_0180: switch(IL_019C)
pop <null>
ldc.i4 0
br IL_0180: switch(IL_019C)
br IL_017C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017C: ldloc V_3
br IL_019C: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310} <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_19c292c64d9946d7bf6951126b2e9118
ldfld System.Int32 <Module>{d9bcc257-42c7-45f8-bdb5-56cc9a335310}::m_7cbd1dc6d8e84ebeae1b05ef3776e101
brtrue IL_0014: switch(IL_0061,IL_0038,IL_01C0)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0061,IL_0038,IL_01C0)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙