c6077f50c2ccb6e4b9263222adcc223e

PE Executable

MD5: c6077f50c2ccb6e4b9263222adcc223e

Size: 586.24 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	c6077f50c2ccb6e4b9263222adcc223e
Sha1	53d00c1228f702931ff7b4e55cdb433858edd491
Sha256	5528b5e88656593ef5c680980621855ef84389efd06fb441a01ff3b48d8bdeb9
Sha384	a08ce8fe935e7d0b2d469b7fb30c13ca844243eb9f0694948331894a3f0d90d544b0e17a01741bbe100ca491872488b7
Sha512	f5589ce93e3e5157f4ef0ee79a7c76a676b25be0c742f1fd5e410f6a92554fff93a477ad788300754938793479f3006b189eba5208de41fb96e79181020fb7a0
SSDeep	12288:0nYdRAqcY92s5skUSab+xkyFcz7JgVEn/+k3JJQeUGIVfUjIs:nSGOnbDy1Va2UPQeUGS8
TLSH	5FC46D2B36928E21C2890733C1DB850093E69A4376A7EB6F35C513DA1D423FEDA47797

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	Alanfp.exe
Full Name	Alanfp.exe
EntryPoint	System.Void quZQ3FJ1l0ACaYwedq.dJN4pP7P0pNQiRuiAd::sbBQqhFtN()
Scope Name	Alanfp.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Alanfp
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void quZQ3FJ1l0ACaYwedq.dJN4pP7P0pNQiRuiAd::sbBQqhFtN()
Main IL Instruction Count	98
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0010: ldloc V_1 br IL_01B7: ret nop <null> ldsfld aKDfvC74sVaOo5puudZ aKDfvC74sVaOo5puudZ::UJu7CC2rMP call System.Byte[] aKDfvC74sVaOo5puudZ::qbs7sdIG08(aKDfvC74sVaOo5puudZ) stloc.s V_2 ldc.i4 2 ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_68d2671c6a1740b69210c813448bd50a brtrue IL_0076: switch(IL_0096,IL_0117) pop <null> ldc.i4 0 br IL_0076: switch(IL_0096,IL_0117) br IL_0072: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0072: ldloc V_0 br IL_0117: leave IL_01B7 ldc.i4 -1555141049 ldc.i4 196137609 sub <null> ldc.i4 -1399180559 xor <null> ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_caa48c49af43420a85679d278a8cafb1 xor <null> ldsfld t4Fxsf7gw15Lohf4Zn1 t4Fxsf7gw15Lohf4Zn1::iYC7XhOAYC call System.String t4Fxsf7gw15Lohf4Zn1::qbs7sdIG08(System.Int32,t4Fxsf7gw15Lohf4Zn1) ldc.i4 684642820 ldc.i4 1109266452 sub <null> ldc.i4 -1278516257 xor <null> ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_5c32ff65bae34209908657dfadf40720 xor <null> ldsfld t4Fxsf7gw15Lohf4Zn1 t4Fxsf7gw15Lohf4Zn1::iYC7XhOAYC call System.String t4Fxsf7gw15Lohf4Zn1::qbs7sdIG08(System.Int32,t4Fxsf7gw15Lohf4Zn1) newobj System.Void mt4i7lhYNRihLWK9uK.Ifmd2A6DgqUXJ6JWoR::.ctor(System.String,System.String) newobj System.Void SJJKe90whAreGDZU0CY.aDkNaa0ZqUDOOoKeTB3::.ctor(mt4i7lhYNRihLWK9uK.Ifmd2A6DgqUXJ6JWoR) ldloc.s V_2 ldsfld QlAgBG7qK7e1CkZ9Fqp QlAgBG7qK7e1CkZ9Fqp::cJL7VCUvwP call System.Void QlAgBG7qK7e1CkZ9Fqp::qbs7sdIG08(System.Object,System.Byte[],QlAgBG7qK7e1CkZ9Fqp) ldc.i4 2 ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_84da0795023748949c33b860d401e2cc brtrue IL_0076: switch(IL_0096,IL_0117) pop <null> ldc.i4 1 br IL_0076: switch(IL_0096,IL_0117) leave IL_01B7: ret pop <null> ldc.i4 0 ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_ef8ee94e872341729502c7ec40d93145 brtrue IL_014E: switch(IL_016A) pop <null> ldc.i4 0 br IL_014E: switch(IL_016A) br IL_014A: ldloc V_3 ldc.i4 0 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 988 beq IL_014A: ldloc V_3 br IL_016A: leave IL_01B7 leave IL_01B7: ret ldc.i4 2 ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_20c4180653da44edb3f4cd9d777aff4a brtrue IL_0014: switch(IL_0038,IL_018E,IL_01B7) pop <null> ldc.i4 0 br IL_0014: switch(IL_0038,IL_018E,IL_01B7) ldsfld HQOADg78qFPp3uFOdcy HQOADg78qFPp3uFOdcy::TqF7cwgpm4 call System.Void HQOADg78qFPp3uFOdcy::qbs7sdIG08(HQOADg78qFPp3uFOdcy) ldc.i4 0 ldsfld <Module>{8671c647-3701-46f0-b929-5080aa9a7735} <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_7ed957e00a794352ae8f1defd32eb834 ldfld System.Int32 <Module>{8671c647-3701-46f0-b929-5080aa9a7735}::m_730c9d03aa104ff9bf26abe59321299b brtrue IL_0014: switch(IL_0038,IL_018E,IL_01B7) pop <null> ldc.i4 2 br IL_0014: switch(IL_0038,IL_018E,IL_01B7) ret <null>
Info	PE Detect: PeReader OK (file layout)

No malware configuration was found at this point.

You must be signed in to view YARA rules.