Malicious
Malicious

b03101e840749fea73d3119cdeed8d2f

Share on LinkedIn
Print
PE Executable
MD5: b03101e840749fea73d3119cdeed8d2f
Size: 828.93 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b03101e840749fea73d3119cdeed8d2f
Sha1 a4318b4871de9f5901f6a9f9b71959e9b47c47cb
Sha256 b77026879f04bcb5090933292303e6213b9ffb75d0921cac5d8bf5feb9c37191
Sha384 864971504871f039de713eeddb94ee034b3f2229a7ae905d2b37dcbeaf83413f3a1804f48504687e2e729cdf9f2277a6
Sha512 3ed258e4c68c96f64f71e0d925039a80359a047a9d5802f89b1cf63bf4fcc854b8453b887f38c4625d2b5fa13be1c4aed0d6e232e7615a1a2ab6ca19ce3a51a9
SSDeep 12288:taz4kUDIYkYwwxlPyZVCSufhO+wLByKPPWY7epHYWjZSi9DPvd2U:BhwsFJh1E0KP15i9DPvd2
TLSH A305BF3B32964E21C24A5373C1C7490087AA968736ABE70B75C513D61D473FEEE4A39B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b03101e840749fea73d3119cdeed8d2f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
pAHOoYdpiRFR18rtxD.VK8wnaklxd81hF3vx8
OGgfgIpUCd0qyN4JCA.iENKMY8NtemcXjBYqE
bLnmvJQ5UVBSSYOvuE.pCipmrLcRBo7sI8M5C
4MWyX2D4mSF2IHXMYt.Unla4aUFSURIhRQUhy
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Yqhjfetyt.exe
Full Name
Yqhjfetyt.exe
EntryPoint
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Scope Name
Yqhjfetyt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqhjfetyt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
ldsfld RalGqMFdJBJfF4OuCAH RalGqMFdJBJfF4OuCAH::tGcFkLdlCL
call System.Void RalGqMFdJBJfF4OuCAH::wngFSsqt3y(RalGqMFdJBJfF4OuCAH)
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld LFxM5gFpoJEF01tBf0C LFxM5gFpoJEF01tBf0C::vD9F8O61oK
call System.Byte[] LFxM5gFpoJEF01tBf0C::wngFSsqt3y(LFxM5gFpoJEF01tBf0C)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0150,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 409302861
ldc.i4 409302861
ldc.i4 -1230543856
add <null>
ldc.i4 -1129828924
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
ldc.i4 621363130
ldc.i4 -1797762438
xor <null>
ldc.i4 -1898845753
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_bf81b90e29de4aca9699d5ecadbd1f09
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
newobj System.Void a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld qyjqhUFxVis0CGWxcq6 qyjqhUFxVis0CGWxcq6::CkcFq0BTYL
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD qyjqhUFxVis0CGWxcq6::wngFSsqt3y(System.Object,System.Byte[],qyjqhUFxVis0CGWxcq6)
ldsfld X607atFmG3SpxiARHQt X607atFmG3SpxiARHQt::DpuFXppG1d
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD X607atFmG3SpxiARHQt::wngFSsqt3y(System.Object,X607atFmG3SpxiARHQt)
ldsfld lgql2lFRAG5UF3EPtSa lgql2lFRAG5UF3EPtSa::l0qFwTx0BW
call System.Void lgql2lFRAG5UF3EPtSa::wngFSsqt3y(System.Object,lgql2lFRAG5UF3EPtSa)
ldc.i4 7
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
brfalse IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0150,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_80c7340abe1f4fbe8d01383c59574412
brtrue IL_0187: switch(IL_01A3)
pop <null>
ldc.i4 3
br IL_0187: switch(IL_01A3)
br IL_0183: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0183: ldloc V_3
br IL_01A3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_9c250aaca277453eb3790de322f13afc
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Yqhjfetyt.exe
Full Name
Yqhjfetyt.exe
EntryPoint
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Scope Name
Yqhjfetyt.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqhjfetyt
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void wULMgQMsYYAer8Tsmo.d8HpLEFJljQDrAUppB::XOpxwK6Hv()
Main IL Instruction Count
101
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0038: ret
ret <null>
ldsfld RalGqMFdJBJfF4OuCAH RalGqMFdJBJfF4OuCAH::tGcFkLdlCL
call System.Void RalGqMFdJBJfF4OuCAH::wngFSsqt3y(RalGqMFdJBJfF4OuCAH)
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld LFxM5gFpoJEF01tBf0C LFxM5gFpoJEF01tBf0C::vD9F8O61oK
call System.Byte[] LFxM5gFpoJEF01tBf0C::wngFSsqt3y(LFxM5gFpoJEF01tBf0C)
stloc.s V_1
ldc.i4 5
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_cbb09c78f65147e3b33928091f0a6918
brtrue IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0150,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 409302861
ldc.i4 409302861
ldc.i4 -1230543856
add <null>
ldc.i4 -1129828924
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
ldc.i4 621363130
ldc.i4 -1797762438
xor <null>
ldc.i4 -1898845753
xor <null>
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_bf81b90e29de4aca9699d5ecadbd1f09
xor <null>
ldsfld bp36lOFFRUtJuXnmal8 bp36lOFFRUtJuXnmal8::kHPFMl3GAl
call System.String bp36lOFFRUtJuXnmal8::wngFSsqt3y(System.Int32,bp36lOFFRUtJuXnmal8)
newobj System.Void a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld qyjqhUFxVis0CGWxcq6 qyjqhUFxVis0CGWxcq6::CkcFq0BTYL
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD qyjqhUFxVis0CGWxcq6::wngFSsqt3y(System.Object,System.Byte[],qyjqhUFxVis0CGWxcq6)
ldsfld X607atFmG3SpxiARHQt X607atFmG3SpxiARHQt::DpuFXppG1d
call a7Gn2BD1BGqihENP0vS.h8fCGhDSXwZJjhSkWhD X607atFmG3SpxiARHQt::wngFSsqt3y(System.Object,X607atFmG3SpxiARHQt)
ldsfld lgql2lFRAG5UF3EPtSa lgql2lFRAG5UF3EPtSa::l0qFwTx0BW
call System.Void lgql2lFRAG5UF3EPtSa::wngFSsqt3y(System.Object,lgql2lFRAG5UF3EPtSa)
ldc.i4 7
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_112c689962f740879a03ccdb9d6f9e77
brfalse IL_00A0: switch(IL_0150,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0150,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_80c7340abe1f4fbe8d01383c59574412
brtrue IL_0187: switch(IL_01A3)
pop <null>
ldc.i4 3
br IL_0187: switch(IL_01A3)
br IL_0183: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0183: ldloc V_3
br IL_01A3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31} <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_66d1aaae615b4b068e73273cc2356e98
ldfld System.Int32 <Module>{62d1d90c-fe50-45e3-8064-c7048fad4a31}::m_9c250aaca277453eb3790de322f13afc
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙