Malicious
Malicious

b03101e840749fea73d3119cdeed8d2f

PE Executable
MD5: b03101e840749fea73d3119cdeed8d2f
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b03101e840749fea73d3119cdeed8d2f
Sha1 a4318b4871de9f5901f6a9f9b71959e9b47c47cb
Sha256 b77026879f04bcb5090933292303e6213b9ffb75d0921cac5d8bf5feb9c37191
Sha384 864971504871f039de713eeddb94ee034b3f2229a7ae905d2b37dcbeaf83413f3a1804f48504687e2e729cdf9f2277a6
Sha512 3ed258e4c68c96f64f71e0d925039a80359a047a9d5802f89b1cf63bf4fcc854b8453b887f38c4625d2b5fa13be1c4aed0d6e232e7615a1a2ab6ca19ce3a51a9
SSDeep 12288:taz4kUDIYkYwwxlPyZVCSufhO+wLByKPPWY7epHYWjZSi9DPvd2U:BhwsFJh1E0KP15i9DPvd2
TLSH A305BF3B32964E21C24A5373C1C7490087AA968736ABE70B75C513D61D473FEEE4A39B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b03101e840749fea73d3119cdeed8d2f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
pAHOoYdpiRFR18rtxD.VK8wnaklxd81hF3vx8
OGgfgIpUCd0qyN4JCA.iENKMY8NtemcXjBYqE
bLnmvJQ5UVBSSYOvuE.pCipmrLcRBo7sI8M5C
4MWyX2D4mSF2IHXMYt.Unla4aUFSURIhRQUhy
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Yqhjfetyt.exe
Full Name
Yqhjfetyt.exe
EntryPoint
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Scope Name
Yqhjfetyt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqhjfetyt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
ldsfld RalGqMFdJBJfF4OuCAH RalGqMFdJBJfF4OuCAH::tGcFkLdlCL
call System.Void RalGqMFdJBJfF4OuCAH::wngFSsqt3y(RalGqMFdJBJfF4OuCAH)
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld LFxM5gFpoJEF01tBf0C LFxM5gFpoJEF01tBf0C::vD9F8O61oK
call System.Byte[] LFxM5gFpoJEF01tBf0C::wngFSsqt3y(LFxM5gFpoJEF01tBf0C)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0150,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 409302861
ldc.i4 409302861
ldc.i4 -1230543856
add <null>
ldc.i4 -1129828924
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
ldc.i4 621363130
ldc.i4 -1797762438
xor <null>
ldc.i4 -1898845753
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_bf81b90e29de4aca9699d5ecadbd1f09
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
newobj System.Void a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld qyjqhUFxVis0CGWxcq6 qyjqhUFxVis0CGWxcq6::CkcFq0BTYL
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD qyjqhUFxVis0CGWxcq6::wngFSsqt3y(System.Object,System.Byte[],qyjqhUFxVis0CGWxcq6)
ldsfld X607atFmG3SpxiARHQt X607atFmG3SpxiARHQt::DpuFXppG1d
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD X607atFmG3SpxiARHQt::wngFSsqt3y(System.Object,X607atFmG3SpxiARHQt)
ldsfld lgql2lFRAG5UF3EPtSa lgql2lFRAG5UF3EPtSa::l0qFwTx0BW
call System.Void lgql2lFRAG5UF3EPtSa::wngFSsqt3y(System.Object,lgql2lFRAG5UF3EPtSa)
ldc.i4 7
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
brfalse IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0150,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_80c7340abe1f4fbe8d01383c59574412
brtrue IL_0187: switch(IL_01A3)
pop <null>
ldc.i4 3
br IL_0187: switch(IL_01A3)
br IL_0183: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0183: ldloc V_3
br IL_01A3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_9c250aaca277453eb3790de322f13afc
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Yqhjfetyt.exe
Full Name
Yqhjfetyt.exe
EntryPoint
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Scope Name
Yqhjfetyt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqhjfetyt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
ldsfld RalGqMFdJBJfF4OuCAH RalGqMFdJBJfF4OuCAH::tGcFkLdlCL
call System.Void RalGqMFdJBJfF4OuCAH::wngFSsqt3y(RalGqMFdJBJfF4OuCAH)
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld LFxM5gFpoJEF01tBf0C LFxM5gFpoJEF01tBf0C::vD9F8O61oK
call System.Byte[] LFxM5gFpoJEF01tBf0C::wngFSsqt3y(LFxM5gFpoJEF01tBf0C)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0150,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 409302861
ldc.i4 409302861
ldc.i4 -1230543856
add <null>
ldc.i4 -1129828924
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
ldc.i4 621363130
ldc.i4 -1797762438
xor <null>
ldc.i4 -1898845753
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_bf81b90e29de4aca9699d5ecadbd1f09
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
newobj System.Void a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld qyjqhUFxVis0CGWxcq6 qyjqhUFxVis0CGWxcq6::CkcFq0BTYL
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD qyjqhUFxVis0CGWxcq6::wngFSsqt3y(System.Object,System.Byte[],qyjqhUFxVis0CGWxcq6)
ldsfld X607atFmG3SpxiARHQt X607atFmG3SpxiARHQt::DpuFXppG1d
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD X607atFmG3SpxiARHQt::wngFSsqt3y(System.Object,X607atFmG3SpxiARHQt)
ldsfld lgql2lFRAG5UF3EPtSa lgql2lFRAG5UF3EPtSa::l0qFwTx0BW
call System.Void lgql2lFRAG5UF3EPtSa::wngFSsqt3y(System.Object,lgql2lFRAG5UF3EPtSa)
ldc.i4 7
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
brfalse IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0150,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_80c7340abe1f4fbe8d01383c59574412
brtrue IL_0187: switch(IL_01A3)
pop <null>
ldc.i4 3
br IL_0187: switch(IL_01A3)
br IL_0183: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0183: ldloc V_3
br IL_01A3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_9c250aaca277453eb3790de322f13afc
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
b03101e840749fea73d3119cdeed8d2f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
pAHOoYdpiRFR18rtxD.VK8wnaklxd81hF3vx8
OGgfgIpUCd0qyN4JCA.iENKMY8NtemcXjBYqE
bLnmvJQ5UVBSSYOvuE.pCipmrLcRBo7sI8M5C
4MWyX2D4mSF2IHXMYt.Unla4aUFSURIhRQUhy
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙