Malicious
Malicious

c5bee4bbdab0a5b20748f266772d4189

Share on LinkedIn
Print
PE Executable
MD5: c5bee4bbdab0a5b20748f266772d4189
Size: 827.9 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c5bee4bbdab0a5b20748f266772d4189
Sha1 5d31db1e638af76a103e288f08f39d67728d92db
Sha256 78f623acdbf8541288cfc969fe4c39ca194939bfb30e921dc2d6d9bc4012b4ff
Sha384 9dcac0ebfcb820f669f2ec6eb39b5bde05436e3c1b6b9e762ce332a3c6a73c9152b7a3cfcc3d4772b3f871a702bca325
Sha512 18f6d0473f9ab3b8a7771664d4c814e5e7d880fa6096b0af2c13c97da0fb0a5da9a857ba9927d56d545e9efac58a0b872cea90fce3634de54ebb56d6163fc6cc
SSDeep 12288:EVYGxhn+LlyotBhEUd2rGNWCjJgbjekdJxXthWwZribw:E6inaBJXJgff75iw
TLSH 4305AE2A32958F21C28A5372C1D7890097A6D647B6ABEB0B31C413D61D473FEDA4B3D7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
c5bee4bbdab0a5b20748f266772d4189
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yyDDLAuyBK7L7Z8AE3.6UVnZyxpcJCN8lYaTi
U5nsNeMClKaGLW7vXg.JafSGlvdh1jK3cL4na
4caDu5GUcCtAZiWJ8W.vNErM2pIbA8UiVcDtD
dYCZlHFf24Htn94oLi.nG25VD0F4gostW5Jul
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Cmbrv.exe
Full Name
Cmbrv.exe
EntryPoint
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Scope Name
Cmbrv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cmbrv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: ret
ldsfld sdsUmD4uNBBTPnInEwy sdsUmD4uNBBTPnInEwy::q1k4x982Qf
call System.Void sdsUmD4uNBBTPnInEwy::Bf24tlCjLl(sdsUmD4uNBBTPnInEwy)
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_1b52d69b77ea485da869e961cd5d4ed2
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld DVW7ck4MVw47t3AM9qv DVW7ck4MVw47t3AM9qv::Pna4vgJegn
call System.Byte[] DVW7ck4MVw47t3AM9qv::Bf24tlCjLl(DVW7ck4MVw47t3AM9qv)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_47ea7b6d04894ffa9c9a210cf41ccd67
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 417394197
ldc.i4 417394197
ldc.i4 1295767520
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_e981bfc1eb0447d5869d082197110afd
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
ldc.i4 298495725
ldc.i4 3
shl <null>
ldc.i4 -680411441
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_ec02e8f784024046b67cc73b45ca5f3e
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
newobj System.Void PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld DfGoH14cyPMaedqAY9y DfGoH14cyPMaedqAY9y::hk34mfcQP7
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW DfGoH14cyPMaedqAY9y::Bf24tlCjLl(System.Object,System.Byte[],DfGoH14cyPMaedqAY9y)
ldsfld dMHkbJ4DYRsfsqveSVR dMHkbJ4DYRsfsqveSVR::d054qDr1bQ
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW dMHkbJ4DYRsfsqveSVR::Bf24tlCjLl(System.Object,dMHkbJ4DYRsfsqveSVR)
ldsfld NFXx5e4TFEqMdn99uAB NFXx5e4TFEqMdn99uAB::Paw4LgoskM
call System.Void NFXx5e4TFEqMdn99uAB::Bf24tlCjLl(System.Object,NFXx5e4TFEqMdn99uAB)
ldc.i4 4
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_f612fcc488a7434985a2fc9d150a4f0e
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_b476fe6a53714cdcbf41e373617adf45
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8443aa5ba772426a962d9b59c5f5adc6
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
Module Name
Cmbrv.exe
Full Name
Cmbrv.exe
EntryPoint
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Scope Name
Cmbrv.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cmbrv
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void tcvCAcbJH86FSZsyvW.KhMiD54EEcyoaXNvO2::EDScusSSY()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0061: ret
ldsfld sdsUmD4uNBBTPnInEwy sdsUmD4uNBBTPnInEwy::q1k4x982Qf
call System.Void sdsUmD4uNBBTPnInEwy::Bf24tlCjLl(sdsUmD4uNBBTPnInEwy)
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_1b52d69b77ea485da869e961cd5d4ed2
brtrue IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld DVW7ck4MVw47t3AM9qv DVW7ck4MVw47t3AM9qv::Pna4vgJegn
call System.Byte[] DVW7ck4MVw47t3AM9qv::Bf24tlCjLl(DVW7ck4MVw47t3AM9qv)
stloc.s V_2
ldc.i4 6
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_47ea7b6d04894ffa9c9a210cf41ccd67
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 417394197
ldc.i4 417394197
ldc.i4 1295767520
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_e981bfc1eb0447d5869d082197110afd
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
ldc.i4 298495725
ldc.i4 3
shl <null>
ldc.i4 -680411441
xor <null>
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_ec02e8f784024046b67cc73b45ca5f3e
xor <null>
ldsfld SHeTdF44tmmrgrTrPKE SHeTdF44tmmrgrTrPKE::wky4b2lvNy
call System.String SHeTdF44tmmrgrTrPKE::Bf24tlCjLl(System.Int32,SHeTdF44tmmrgrTrPKE)
newobj System.Void PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld DfGoH14cyPMaedqAY9y DfGoH14cyPMaedqAY9y::hk34mfcQP7
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW DfGoH14cyPMaedqAY9y::Bf24tlCjLl(System.Object,System.Byte[],DfGoH14cyPMaedqAY9y)
ldsfld dMHkbJ4DYRsfsqveSVR dMHkbJ4DYRsfsqveSVR::d054qDr1bQ
call PKT9B6Feugx9abpHkuP.nM2v53FtYTdNpIxpmRW dMHkbJ4DYRsfsqveSVR::Bf24tlCjLl(System.Object,dMHkbJ4DYRsfsqveSVR)
ldsfld NFXx5e4TFEqMdn99uAB NFXx5e4TFEqMdn99uAB::Paw4LgoskM
call System.Void NFXx5e4TFEqMdn99uAB::Bf24tlCjLl(System.Object,NFXx5e4TFEqMdn99uAB)
ldc.i4 4
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_f612fcc488a7434985a2fc9d150a4f0e
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_b476fe6a53714cdcbf41e373617adf45
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_017D: ldloc V_1
br IL_019D: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{9fe57269-8ce6-4197-b89b-5314167016d7} <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8656c373fd7a41e6842f4c780e3c7862
ldfld System.Int32 <Module>{9fe57269-8ce6-4197-b89b-5314167016d7}::m_8443aa5ba772426a962d9b59c5f5adc6
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙