Malicious
Malicious

b14c8608cbbf66f7524f59f5d9bf275e

PE Executable
MD5: b14c8608cbbf66f7524f59f5d9bf275e
Size: 1.16 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 b14c8608cbbf66f7524f59f5d9bf275e
Sha1 b96635d5c66cb4a974010b048c32f5d3d61863f0
Sha256 0264d0104ae89e9c45fd1ebba3a20425e8f41cdc16e7deacec9d9608afcf8230
Sha384 7af016c9d2c05b830e71e6d2bea701c9e8a3286d20b9425be45ddde54fc6bda0d9dfbd7dfb0ce5f32ffe241ba8585141
Sha512 021c37fc41f6b7b77bf6d9a71eaf53b86c7055d73a3e0e50acc00bbe80bc5a813a2bc36a4c3835a319394af4d2745903f6ecd0d8d20d60168afd394c15a47c39
SSDeep 24576:651fKX8zkPOEVa4Sbg40a2Khb8i24nGqJESI:alfQW26L5b8j4Gq9I
TLSH 12355BAD3589FCAFC4568971C974FDB1A710AC66C306E10391933D9BB93C693AB090E7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b14c8608cbbf66f7524f59f5d9bf275e
Malicious
.Net Resources
X7g.v7H.resources
AlpinePasture.Properties.Resources.resources
KL
[NBF]root.Data
ntYA
[NBF]root.Data
[NBF]root.Data-preview.png
fOd.VOI.resources
$this.Icon
[NBF]root.IconData
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
OwQC.exe
Full Name
OwQC.exe
EntryPoint
System.Void iNT.aNV::PNh()
Scope Name
OwQC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
OwQC
Assembly Version
2.0.1.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
3
Main Method
System.Void iNT.aNV::PNh()
Main IL Instruction Count
57
Main IL 
br IL_00C6: nop
ldc.i4 -459210088
ldc.i4 -1322870842
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 11
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00E3: nop
newobj System.Void lM.q4::.ctor()
stsfld lM.q4 iNT.aNV::vwA
ldloc.0 <null>
ldc.i4 -646036185
mul <null>
ldc.i4 1033274433
xor <null>
br.s IL_000A: ldc.i4 -1322870842
ldsfld lM.q4 iNT.aNV::vwA
call System.Void iNT.aNV::‏‏​‪‫‪‬‌‬‌‮‌‪‌‪‏‭‪‍‍‍‪‮‭​‪‏‪‬‎‮(System.Windows.Forms.Form)
ldc.i4 -1331750074
br.s IL_000A: ldc.i4 -1322870842
call System.Void iNT.aNV::‭‪‬​‌‪‍‍‎‬‏‌‪‎‬‭‫‪‭‬‏‍‮()
ldloc.0 <null>
ldc.i4 1864517143
mul <null>
ldc.i4 707952939
xor <null>
br.s IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4 -1008281693
br IL_000A: ldc.i4 -1322870842
ldloc.0 <null>
ldc.i4 1429485886
mul <null>
ldc.i4 1692900381
xor <null>
br IL_000A: ldc.i4 -1322870842
call System.Void UwB.Bwi::k0L()
ldc.i4 -714934762
br IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4.0 <null>
call System.Void iNT.aNV::​‫‌‭‪‫‫‏‬‍‫‎‭​‮‭‎‬‍‍‫​‭‪‭‮‬‍‍‬‏‪‮(System.Boolean)
ldc.i4 -459210088
br IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4 -407939565
br IL_000A: ldc.i4 -1322870842
ldloc.0 <null>
ldc.i4 436452608
mul <null>
ldc.i4 -1593969278
xor <null>
br IL_000A: ldc.i4 -1322870842
nop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
OwQC.exe
Full Name
OwQC.exe
EntryPoint
System.Void iNT.aNV::PNh()
Scope Name
OwQC.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
OwQC
Assembly Version
2.0.1.3
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
3
Main Method
System.Void iNT.aNV::PNh()
Main IL Instruction Count
57
Main IL 
br IL_00C6: nop
ldc.i4 -459210088
ldc.i4 -1322870842
xor <null>
dup <null>
stloc.0 <null>
ldc.i4.s 11
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00E3: nop
newobj System.Void lM.q4::.ctor()
stsfld lM.q4 iNT.aNV::vwA
ldloc.0 <null>
ldc.i4 -646036185
mul <null>
ldc.i4 1033274433
xor <null>
br.s IL_000A: ldc.i4 -1322870842
ldsfld lM.q4 iNT.aNV::vwA
call System.Void iNT.aNV::‏‏​‪‫‪‬‌‬‌‮‌‪‌‪‏‭‪‍‍‍‪‮‭​‪‏‪‬‎‮(System.Windows.Forms.Form)
ldc.i4 -1331750074
br.s IL_000A: ldc.i4 -1322870842
call System.Void iNT.aNV::‭‪‬​‌‪‍‍‎‬‏‌‪‎‬‭‫‪‭‬‏‍‮()
ldloc.0 <null>
ldc.i4 1864517143
mul <null>
ldc.i4 707952939
xor <null>
br.s IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4 -1008281693
br IL_000A: ldc.i4 -1322870842
ldloc.0 <null>
ldc.i4 1429485886
mul <null>
ldc.i4 1692900381
xor <null>
br IL_000A: ldc.i4 -1322870842
call System.Void UwB.Bwi::k0L()
ldc.i4 -714934762
br IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4.0 <null>
call System.Void iNT.aNV::​‫‌‭‪‫‫‏‬‍‫‎‭​‮‭‎‬‍‍‫​‭‪‭‮‬‍‍‬‏‪‮(System.Boolean)
ldc.i4 -459210088
br IL_000A: ldc.i4 -1322870842
nop <null>
ldc.i4 -407939565
br IL_000A: ldc.i4 -1322870842
ldloc.0 <null>
ldc.i4 436452608
mul <null>
ldc.i4 -1593969278
xor <null>
br IL_000A: ldc.i4 -1322870842
nop <null>
ret <null>
b14c8608cbbf66f7524f59f5d9bf275e
Malicious
.Net Resources
X7g.v7H.resources
AlpinePasture.Properties.Resources.resources
KL
[NBF]root.Data
ntYA
[NBF]root.Data
[NBF]root.Data-preview.png
fOd.VOI.resources
$this.Icon
[NBF]root.IconData
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙