Suspicious
Suspect

b7e5d882f64df87f2d70b9df4df1033f

Share on LinkedIn
Print
PE Executable
MD5: b7e5d882f64df87f2d70b9df4df1033f
Size: 39.42 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 b7e5d882f64df87f2d70b9df4df1033f
Sha1 428710fe6cd300d607805b25cea48516275eed76
Sha256 03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db
Sha384 a84504c4e45f94c5929a046b0b9419cb5ac310b3e9a3f7acfc3a3defa9121b86e7f62fd50090d42022ca279f3c610f83
Sha512 aa06483573222487fd28e79f49ce822c103822c0dedb594f563c7ca8fc18ca18ec4b56440b14d386e97f4dfa12f2af7fbd9802225cb5ac0ea3d1f7243c78018b
SSDeep 768:4z57Ngy0RKQnbFY3if1hrTA8DQpOOOOOOOROOOp7OsCCC0OOCnUMGCV8oZ7OOOtP:vnb4itdTAn5x
TLSH 8203C48EDE45967FE55636B150AF9B5002606DFE2A03C73AB8987803FD233D4916363E
b7e5d882f64df87f2d70b9df4df1033f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.rsrc
Resources
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
GeneratedExe.exe
Full Name
GeneratedExe.exe
EntryPoint
System.Void Program::Main()
Scope Name
GeneratedExe.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
GeneratedExe
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
291
Main IL 
nop <null>
ldc.i4 7335
newarr System.Byte
dup <null>
ldtoken <PrivateImplementationDetails>/__StaticArrayInitTypeSize=7335 <PrivateImplementationDetails>::2D24A7BF56001668D72D3E3442B26CFBEA9EB0867715E3A688F77ED654601BD5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 12
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.7 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.8 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 11
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
ldc.i4.s 14
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
ldloc.s V_4
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_0097: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Boolean Program/<>c::<Main>b__0_0(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_00BB: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_1(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_00DF: call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_2(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2
call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.2 <null>
call System.String System.IO.Path::GetTempPath()
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
ldstr .bat
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
nop <null>
ldloc.3 <null>
ldloc.0 <null>
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_11
ldloc.s V_11
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_11
ldstr /C "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean)
nop <null>
ldloc.s V_11
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean)
nop <null>
ldloc.s V_11
stloc.s V_6
ldloc.2 <null>
ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
dup <null>
brtrue.s IL_0199: call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_3(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3
call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
dup <null>
brtrue.s IL_01BD: ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_4(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4
ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
dup <null>
brtrue.s IL_01DC: call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.List`1<System.Int32> Program/<>c::<Main>b__0_5(System.Linq.IGrouping`2<System.Int32,System.Int32>)
newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5
call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>)
stloc.s V_7
ldstr Grouped values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloc.s V_7
callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::GetEnumerator()
stloc.s V_12
br.s IL_0232: ldloca.s V_12
ldloca.s V_12
call System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Current()
stloc.s V_13
nop <null>
ldstr Key {0}: {1}
ldloca.s V_13
call System.Int32 System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Key()
box System.Int32
ldstr , 
ldloca.s V_13
call System.Collections.Generic.List`1<System.Int32> System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Value()
call System.String System.String::Join<System.Int32>(System.String,System.Collections.Generic.IEnumerable`1<System.Int32>)
call System.String System.String::Format(System.String,System.Object,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloca.s V_12
call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::MoveNext()
brtrue.s IL_01FA: ldloca.s V_12
leave.s IL_024C: ldloc.s V_7
ldloca.s V_12
constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_7
ldsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
dup <null>
brtrue.s IL_026D: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Collections.Generic.IEnumerable`1<System.Int32> Program/<>c::<Main>b__0_6(System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>)
newobj System.Void System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>)
ldsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
dup <null>
brtrue.s IL_0291: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Int32 Program/<>c::<Main>b__0_7(System.Int32,System.Int32)
newobj System.Void System.Func`3<System.Int32,System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>)
call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_8
ldstr 
Flattened transformed values:
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldloc.s V_8
ldsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
dup <null>
brtrue.s IL_02C9: callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__0_8(System.Int32)
newobj System.Void System.Action`1<System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>)
nop <null>
nop <null>
nop <null>
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_14
nop <null>
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_15
ldloc.s V_14
callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError()
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_16
ldloc.s V_14
callvirt System.Void System.Diagnostics.Process::WaitForExit()
nop <null>
nop <null>
leave.s IL_030F: ldloc.s V_8
ldloc.s V_14
brfalse.s IL_030E: endfinally
ldloc.s V_14
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeSum|0_9(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_9
ldloc.s V_8
call System.Int32 Program::<Main>g__ComputeWeirdMetric|0_10(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.s V_10
ldstr 
Sum (modded): {0}
ldloc.s V_9
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
ldstr Weird metric: {0}
ldloc.s V_10
box System.Int32
call System.String System.String::Format(System.String,System.Object)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
leave.s IL_0365: ret
nop <null>
nop <null>
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_0363: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0363: nop
nop <null>
endfinally <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙