Malicious
Malicious

c5bee4bbdab0a5b20748f266772d4189

PE Executable
MD5: c5bee4bbdab0a5b20748f266772d4189
Size: 827.9 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c5bee4bbdab0a5b20748f266772d4189
Sha1 5d31db1e638af76a103e288f08f39d67728d92db
Sha256 78f623acdbf8541288cfc969fe4c39ca194939bfb30e921dc2d6d9bc4012b4ff
Sha384 9dcac0ebfcb820f669f2ec6eb39b5bde05436e3c1b6b9e762ce332a3c6a73c9152b7a3cfcc3d4772b3f871a702bca325
Sha512 18f6d0473f9ab3b8a7771664d4c814e5e7d880fa6096b0af2c13c97da0fb0a5da9a857ba9927d56d545e9efac58a0b872cea90fce3634de54ebb56d6163fc6cc
SSDeep 12288:EVYGxhn+LlyotBhEUd2rGNWCjJgbjekdJxXthWwZribw:E6inaBJXJgff75iw
TLSH 4305AE2A32958F21C28A5372C1D7890097A6D647B6ABEB0B31C413D61D473FEDA4B3D7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c5bee4bbdab0a5b20748f266772d4189
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yyDDLAuyBK7L7Z8AE3.6UVnZyxpcJCN8lYaTi
U5nsNeMClKaGLW7vXg.JafSGlvdh1jK3cL4na
4caDu5GUcCtAZiWJ8W.vNErM2pIbA8UiVcDtD
dYCZlHFf24Htn94oLi.nG25VD0F4gostW5Jul
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Cmbrv.exe
Full Name
Cmbrv.exe
EntryPoint
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Scope Name
Cmbrv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cmbrv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: ret
ldsfld sdsUmD4uNBBTPnInEwy sdsUmD4uNBBTPnInEwy::q1k4x982Qf
call System.Void sdsUmD4uNBBTPnInEwy::Bf24tlCjLl(sdsUmD4uNBBTPnInEwy)
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_1b52d69b77ea485da869e961cd5d4ed2
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld DVW7ck4MVw47t3AM9qv DVW7ck4MVw47t3AM9qv::Pna4vgJegn
call System.Byte[] DVW7ck4MVw47t3AM9qv::Bf24tlCjLl(DVW7ck4MVw47t3AM9qv)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_47ea7b6d04894ffa9c9a210cf41ccd67
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 417394197
ldc.i4 417394197
ldc.i4 1295767520
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_e981bfc1eb0447d5869d082197110afd
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
ldc.i4 298495725
ldc.i4 3
shl <null>
ldc.i4 -680411441
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_ec02e8f784024046b67cc73b45ca5f3e
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
newobj System.Void PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld DfGoH14cyPMaedqAY9y DfGoH14cyPMaedqAY9y::hk34mfcQP7
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW DfGoH14cyPMaedqAY9y::Bf24tlCjLl(System.Object,System.Byte[],DfGoH14cyPMaedqAY9y)
ldsfld dMHkbJ4DYRsfsqveSVR dMHkbJ4DYRsfsqveSVR::d054qDr1bQ
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW dMHkbJ4DYRsfsqveSVR::Bf24tlCjLl(System.Object,dMHkbJ4DYRsfsqveSVR)
ldsfld NFXx5e4TFEqMdn99uAB NFXx5e4TFEqMdn99uAB::Paw4LgoskM
call System.Void NFXx5e4TFEqMdn99uAB::Bf24tlCjLl(System.Object,NFXx5e4TFEqMdn99uAB)
ldc.i4 4
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_f612fcc488a7434985a2fc9d150a4f0e
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_b476fe6a53714cdcbf41e373617adf45
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8443aa5ba772426a962d9b59c5f5adc6
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
Module Name
Cmbrv.exe
Full Name
Cmbrv.exe
EntryPoint
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Scope Name
Cmbrv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cmbrv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: ret
ldsfld sdsUmD4uNBBTPnInEwy sdsUmD4uNBBTPnInEwy::q1k4x982Qf
call System.Void sdsUmD4uNBBTPnInEwy::Bf24tlCjLl(sdsUmD4uNBBTPnInEwy)
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_1b52d69b77ea485da869e961cd5d4ed2
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld DVW7ck4MVw47t3AM9qv DVW7ck4MVw47t3AM9qv::Pna4vgJegn
call System.Byte[] DVW7ck4MVw47t3AM9qv::Bf24tlCjLl(DVW7ck4MVw47t3AM9qv)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_47ea7b6d04894ffa9c9a210cf41ccd67
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 417394197
ldc.i4 417394197
ldc.i4 1295767520
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_e981bfc1eb0447d5869d082197110afd
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
ldc.i4 298495725
ldc.i4 3
shl <null>
ldc.i4 -680411441
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_ec02e8f784024046b67cc73b45ca5f3e
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
newobj System.Void PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld DfGoH14cyPMaedqAY9y DfGoH14cyPMaedqAY9y::hk34mfcQP7
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW DfGoH14cyPMaedqAY9y::Bf24tlCjLl(System.Object,System.Byte[],DfGoH14cyPMaedqAY9y)
ldsfld dMHkbJ4DYRsfsqveSVR dMHkbJ4DYRsfsqveSVR::d054qDr1bQ
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW dMHkbJ4DYRsfsqveSVR::Bf24tlCjLl(System.Object,dMHkbJ4DYRsfsqveSVR)
ldsfld NFXx5e4TFEqMdn99uAB NFXx5e4TFEqMdn99uAB::Paw4LgoskM
call System.Void NFXx5e4TFEqMdn99uAB::Bf24tlCjLl(System.Object,NFXx5e4TFEqMdn99uAB)
ldc.i4 4
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_f612fcc488a7434985a2fc9d150a4f0e
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_b476fe6a53714cdcbf41e373617adf45
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8443aa5ba772426a962d9b59c5f5adc6
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
c5bee4bbdab0a5b20748f266772d4189
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yyDDLAuyBK7L7Z8AE3.6UVnZyxpcJCN8lYaTi
U5nsNeMClKaGLW7vXg.JafSGlvdh1jK3cL4na
4caDu5GUcCtAZiWJ8W.vNErM2pIbA8UiVcDtD
dYCZlHFf24Htn94oLi.nG25VD0F4gostW5Jul
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙