Malicious
Malicious

bce09ca9d227824812fc093d4740c1e2

PE Executable
MD5: bce09ca9d227824812fc093d4740c1e2
Size: 642.56 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 bce09ca9d227824812fc093d4740c1e2
Sha1 aa31aa768c2c482a4e0479cfda0f8563c0f1596d
Sha256 00c70ced7798d660752424852041ed47189c5f7fdfbfd939d37e27788d50376f
Sha384 7b42a7a2c21b86ad80d2600c83b0b1b201fbd1fb8d492bfa1af5f787d53886e9d44d3797b6d6e244e787a9a1453c087b
Sha512 0e4e05601042c20497dd6c966d257bd2de8377f9c23831683df4f4cce692fcbf2466d2e43e8e1fd4e19d547bd9d3c3f2bac4a1e3c29d0a1d239bffb1772b1a8a
SSDeep 6144:2Ez75DgGIK3wWv7QmH/s8pwOpB1PDFP0/XJUILsUj0ob8AxGprduG8dlBcNp0WC+:243whmH3pwiB1PkXaQjmAs3NGhoDXq4
TLSH 5CD49EAB77238E61E2896333C0CA894097B59756B5A7E74F314413E215433EECF0B6A7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
bce09ca9d227824812fc093d4740c1e2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
MQRQl2Jr8WxGdX1vde.1DPGMGDsct1dKWlC42
Bt5eb7BSTtSBdnRfcU.CyDdbfXmq50RD0JOpx
liJfZatsrTi2o3Xfpj.3rB3y2QJRm30HuLiLL
Yqfhukmut.g.resources
Kwtpurgsqwb.Properties.Resources.resources
Wnmoezvh
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Yqfhukmut.exe
Full Name
Yqfhukmut.exe
EntryPoint
System.Void juagmtrhEj66aIUayi.NMvvo00tfup4hbWjb4::Wu0l0578h()
Scope Name
Yqfhukmut.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqfhukmut
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void juagmtrhEj66aIUayi.NMvvo00tfup4hbWjb4::Wu0l0578h()
Main IL Instruction Count
58
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Dfs90uYYd4koZZ9qVB.LBViXjE34avf9XfvP7::.ctor()
ldsfld QgWnaPQlcojOqpuY0yu QgWnaPQlcojOqpuY0yu::zqnQMb9NRU
call System.Boolean QgWnaPQlcojOqpuY0yu::TdmQQCSjEJ(System.Object,QgWnaPQlcojOqpuY0yu)
brtrue IL_0096: leave IL_002D
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_70f33c56310141f7aca612920c2c7c11
brfalse IL_0074: switch(IL_0090)
pop <null>
ldc.i4 2
br IL_0074: switch(IL_0090)
br IL_0070: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0070: ldloc V_2
br IL_0090: newobj System.Void System.InvalidOperationException::.ctor()
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_b561db79f97848deb1d720af0a7aac80
brtrue IL_00CD: switch(IL_00E9)
pop <null>
ldc.i4 0
br IL_00CD: switch(IL_00E9)
br IL_00C9: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00C9: ldloc V_0
br IL_00E9: leave IL_002D
leave IL_002D: ret
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_3a3e83567c83452bad57da2d40c4ec0d
brtrue IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
Module Name
Yqfhukmut.exe
Full Name
Yqfhukmut.exe
EntryPoint
System.Void juagmtrhEj66aIUayi.NMvvo00tfup4hbWjb4::Wu0l0578h()
Scope Name
Yqfhukmut.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yqfhukmut
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void juagmtrhEj66aIUayi.NMvvo00tfup4hbWjb4::Wu0l0578h()
Main IL Instruction Count
58
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Dfs90uYYd4koZZ9qVB.LBViXjE34avf9XfvP7::.ctor()
ldsfld QgWnaPQlcojOqpuY0yu QgWnaPQlcojOqpuY0yu::zqnQMb9NRU
call System.Boolean QgWnaPQlcojOqpuY0yu::TdmQQCSjEJ(System.Object,QgWnaPQlcojOqpuY0yu)
brtrue IL_0096: leave IL_002D
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_70f33c56310141f7aca612920c2c7c11
brfalse IL_0074: switch(IL_0090)
pop <null>
ldc.i4 2
br IL_0074: switch(IL_0090)
br IL_0070: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0070: ldloc V_2
br IL_0090: newobj System.Void System.InvalidOperationException::.ctor()
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_b561db79f97848deb1d720af0a7aac80
brtrue IL_00CD: switch(IL_00E9)
pop <null>
ldc.i4 0
br IL_00CD: switch(IL_00E9)
br IL_00C9: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00C9: ldloc V_0
br IL_00E9: leave IL_002D
leave IL_002D: ret
ldc.i4 0
ldsfld <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d} <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_9a48c37af14844088f8cde0f1a61cc40
ldfld System.Int32 <Module>{74d5cbd9-5f1d-42be-b07b-6050376b7f1d}::m_3a3e83567c83452bad57da2d40c4ec0d
brtrue IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
bce09ca9d227824812fc093d4740c1e2
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
MQRQl2Jr8WxGdX1vde.1DPGMGDsct1dKWlC42
Bt5eb7BSTtSBdnRfcU.CyDdbfXmq50RD0JOpx
liJfZatsrTi2o3Xfpj.3rB3y2QJRm30HuLiLL
Yqfhukmut.g.resources
Kwtpurgsqwb.Properties.Resources.resources
Wnmoezvh
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙