c94b9d973f29b916bd3bff83f246c5f6

PE Executable

MD5: c94b9d973f29b916bd3bff83f246c5f6

Size: 1.45 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	c94b9d973f29b916bd3bff83f246c5f6
Sha1	75d53295b807aaa32a98e60865a907d5648152e8
Sha256	355681a8a5f2e3fd549512f56e4a09b7b638417ca660cd5431040b8e5c27366f
Sha384	e620a6f20d3da770abfd1192ff38241103dc91e4b3e8e605aea2b995f8a901afe7d322322d18ef80da4589f3156e9b56
Sha512	f36eda75f3a6cadf15f16b020a9a8cbe0820c0fa0bab6d18336101d42c5030b87ece03baa1c2a28e8ea838e02e6b96c926231c7954a379b2ff303ffbc7ab0aa3
SSDeep	24576:/74yaYqycm+I2KD/Oq+HUtSTDtvuhcL+xE1loWJ/q:Tm3rdKTqrP58
TLSH	2965F10417D606A4E1BAE734D776026083F0FDAB8572D3EF66C410EC5E26B5BA692373

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2

bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>scr:vbs

Shape pe:exe>scr:vbs

2 nodes

Name	Value
Module Name	9awBw
Full Name	9awBw
EntryPoint	System.Void 9awBw.1gbSjdJ70Min::qMn59rbGeR7()
Scope Name	9awBw
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	9awBw
Assembly Version	14.26.39.52
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1228
Main Method	System.Void 9awBw.1gbSjdJ70Min::qMn59rbGeR7()
Main IL Instruction Count	14
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldstr 6423897.bak call System.Void 9awBw.pe1Jr5Cs3Wr::Moe4mi5ZK7j(System.String) nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.0 <null> call System.Void System.Windows.Forms.Application::Exit() nop <null> ret <null>`
Info	PE Detect: PeReader OK (file layout)
Module Name	9awBw
Full Name	9awBw
EntryPoint	System.Void 9awBw.1gbSjdJ70Min::qMn59rbGeR7()
Scope Name	9awBw
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	9awBw
Assembly Version	14.26.39.52
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1228
Main Method	System.Void 9awBw.1gbSjdJ70Min::qMn59rbGeR7()
Main IL Instruction Count	14
Main IL	`nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> ldstr 6423897.bak call System.Void 9awBw.pe1Jr5Cs3Wr::Moe4mi5ZK7j(System.String) nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.0 <null> call System.Void System.Windows.Forms.Application::Exit() nop <null> ret <null>`

No malware configuration was found at this point.

You must be signed in to view YARA rules.