Suspicious
Suspect

b7e5d882f64df87f2d70b9df4df1033f

PE Executable
MD5: b7e5d882f64df87f2d70b9df4df1033f
Size: 39.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 b7e5d882f64df87f2d70b9df4df1033f
Sha1 428710fe6cd300d607805b25cea48516275eed76
Sha256 03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db
Sha384 a84504c4e45f94c5929a046b0b9419cb5ac310b3e9a3f7acfc3a3defa9121b86e7f62fd50090d42022ca279f3c610f83
Sha512 aa06483573222487fd28e79f49ce822c103822c0dedb594f563c7ca8fc18ca18ec4b56440b14d386e97f4dfa12f2af7fbd9802225cb5ac0ea3d1f7243c78018b
SSDeep 768:4z57Ngy0RKQnbFY3if1hrTA8DQpOOOOOOOROOOp7OsCCC0OOCnUMGCV8oZ7OOOtP:vnb4itdTAn5x
TLSH 8203C48EDE45967FE55636B150AF9B5002606DFE2A03C73AB8987803FD233D4916363E
b7e5d882f64df87f2d70b9df4df1033f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
GeneratedExe.exe
Full Name
GeneratedExe.exe
EntryPoint
System.Void Program::Main()
Scope Name
GeneratedExe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GeneratedExe
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
291
Main IL 
nop <null>
ldc.i4 7335
newarr System.Byte
dup <null>
ldtoken <PrivateImplementationDetails>/__StaticArrayInitTypeSize=7335 <PrivateImplementationDetails>::2D24A7BF56001668D72D3E3442B26CFBEA9EB0867715E3A688F77ED654601BD5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 12
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.7 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.8 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 11
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_0097: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Boolean Program/<>c::<Main>b__0_0(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_00BB: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_1(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_00DF: call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_2(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .bat
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
nop <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_11
ldloc.s V_11
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_11
ldstr /C "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean)
nop <null>
ldloc.s V_11
stloc.s V_6
ldloc.2 <null>
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
dup <null>
brtrue.s IL_0199: call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_3(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
dup <null>
brtrue.s IL_01BD: ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_4(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
dup <null>
brtrue.s IL_01DC: call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.List`1<System.Int32> Program/<>c::<Main>b__0_5(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
stloc.s V_7
ldstr Grouped values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::GetEnumerator()
stloc.s V_12
br.s IL_0232: ldloca.s V_12
ldloca.s V_12
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Current()
stloc.s V_13
nop <null>
ldstr Key {0}: {1}
ldloca.s V_13
call System.Int32 System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Key()
box System.Int32
ldstr , 
ldloca.s V_13
call System.Collections.Generic.List`1<System.Int32> System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Value()
call System.String System.String::Join<System.Int32>(System.String,System.Collections.Generic.IEnumerable`1<System.Int32>)
call System.String System.String::Format(System.String,System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloca.s V_12
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::MoveNext()
brtrue.s IL_01FA: ldloca.s V_12
leave.s IL_024C: ldloc.s V_7
ldloca.s V_12
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_7
ldsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
dup <null>
brtrue.s IL_026D: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.IEnumerable`1<System.Int32> Program/<>c::<Main>b__0_6(System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>)
newobj System.Void System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
ldsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
dup <null>
brtrue.s IL_0291: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_7(System.Int32,System.Int32)
newobj System.Void System.Func`3<System.Int32,System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_8
ldstr 
Flattened transformed values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldloc.s V_8
ldsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
dup <null>
brtrue.s IL_02C9: callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__0_8(System.Int32)
newobj System.Void System.Action`1<System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
nop <null>
nop <null>
nop <null>
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_14
nop <null>
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_15
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_16
ldloc.s V_14
callvirt System.Void System.Diagnostics.Process::WaitForExit()
nop <null>
nop <null>
leave.s IL_030F: ldloc.s V_8
ldloc.s V_14
brfalse.s IL_030E: endfinally
ldloc.s V_14
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeSum|0_9(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_9
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeWeirdMetric|0_10(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_10
ldstr 
Sum (modded): {0}
ldloc.s V_9
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldstr Weird metric: {0}
ldloc.s V_10
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_0365: ret
nop <null>
nop <null>
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_0363: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0363: nop
nop <null>
endfinally <null>
ret <null>
b7e5d882f64df87f2d70b9df4df1033f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙