Suspicious
Suspect

b1b1779c322c026e9b93c8b0bcf80d42

PE Executable
MD5: b1b1779c322c026e9b93c8b0bcf80d42
Size: 103.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 b1b1779c322c026e9b93c8b0bcf80d42
Sha1 6a41e4962c97a1c3b9d9ce9aafc5c357b298d3b0
Sha256 47b7959bb57dd0753a9e26f1e2593f2ed1ea5fc31a10c2c0a51034fef8147cf5
Sha384 2d977301fb5c0b458469c1999c9fa32953fe79f426a781efc48227c0eaefe059d7d1c0aa2e579a98ac80a3d7fe416bca
Sha512 546aef72a62fb7ccce272d7039584937b4789f27c8d59d6db3ff6cb13c8d0fa26e2a3808e94b33862f62f2052042a679c9243da02d66878c90b134ecf34d1596
SSDeep 3072:zIb0grvFggrvFtcoQntK+C7VieM3SFZNt9cw:zIb0AOAPTQwX3MmI
TLSH 37A3AEB3D2DF349EC843A2BA6456C0C79B4BBC0B6C0A0E7179A83D416B6B35563CDD46
b1b1779c322c026e9b93c8b0bcf80d42
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1
Name Value
Module Name
GeneratedExe.exe
Full Name
GeneratedExe.exe
EntryPoint
System.Void Program::Main()
Scope Name
GeneratedExe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GeneratedExe
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
291
Main IL 
nop <null>
ldc.i4 33106
newarr System.Byte
dup <null>
ldtoken <PrivateImplementationDetails>/__StaticArrayInitTypeSize=33106 <PrivateImplementationDetails>::90ED9B4F23C181A7F9B193AA7F924C27CE7C8395947FDFFD92F89AB6E19C77C6
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 12
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.7 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.8 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 11
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_0097: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Boolean Program/<>c::<Main>b__0_0(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_00BB: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_1(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_00DF: call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_2(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .bat
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
nop <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_11
ldloc.s V_11
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_11
ldstr /C "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean)
nop <null>
ldloc.s V_11
stloc.s V_6
ldloc.2 <null>
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
dup <null>
brtrue.s IL_0199: call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_3(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
dup <null>
brtrue.s IL_01BD: ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_4(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
dup <null>
brtrue.s IL_01DC: call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.List`1<System.Int32> Program/<>c::<Main>b__0_5(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
stloc.s V_7
ldstr Grouped values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::GetEnumerator()
stloc.s V_12
br.s IL_0232: ldloca.s V_12
ldloca.s V_12
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Current()
stloc.s V_13
nop <null>
ldstr Key {0}: {1}
ldloca.s V_13
call System.Int32 System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Key()
box System.Int32
ldstr , 
ldloca.s V_13
call System.Collections.Generic.List`1<System.Int32> System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Value()
call System.String System.String::Join<System.Int32>(System.String,System.Collections.Generic.IEnumerable`1<System.Int32>)
call System.String System.String::Format(System.String,System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloca.s V_12
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::MoveNext()
brtrue.s IL_01FA: ldloca.s V_12
leave.s IL_024C: ldloc.s V_7
ldloca.s V_12
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_7
ldsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
dup <null>
brtrue.s IL_026D: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.IEnumerable`1<System.Int32> Program/<>c::<Main>b__0_6(System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>)
newobj System.Void System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
ldsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
dup <null>
brtrue.s IL_0291: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_7(System.Int32,System.Int32)
newobj System.Void System.Func`3<System.Int32,System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_8
ldstr 
Flattened transformed values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldloc.s V_8
ldsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
dup <null>
brtrue.s IL_02C9: callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__0_8(System.Int32)
newobj System.Void System.Action`1<System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
nop <null>
nop <null>
nop <null>
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_14
nop <null>
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_15
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_16
ldloc.s V_14
callvirt System.Void System.Diagnostics.Process::WaitForExit()
nop <null>
nop <null>
leave.s IL_030F: ldloc.s V_8
ldloc.s V_14
brfalse.s IL_030E: endfinally
ldloc.s V_14
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeSum|0_9(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_9
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeWeirdMetric|0_10(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_10
ldstr 
Sum (modded): {0}
ldloc.s V_9
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldstr Weird metric: {0}
ldloc.s V_10
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_0365: ret
nop <null>
nop <null>
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_0363: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0363: nop
nop <null>
endfinally <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
b1b1779c322c026e9b93c8b0bcf80d42
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙