Malicious
Malicious

ccd17bd6ab254b13997dca4fee39f230

PE Executable
MD5: ccd17bd6ab254b13997dca4fee39f230
Size: 428.54 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 ccd17bd6ab254b13997dca4fee39f230
Sha1 a426c93c2526a2cdd21f7ed77596f6fd83449df0
Sha256 2dade2f99d5058f68c38d45e07e0d3f5ad2574e1aeb9eeeac32d93027f6c5624
Sha384 fd0b064d7e5dfbe7eaa824ae5d4475c80ce502591be56bcf5c87a502b125fc752b12f8473f91ddeaa9c3a3c2e6d7a339
Sha512 044221c0d944ce38ca7cdd6683a33b1562dc2bf669f09ac9f2d4edb8b0f12d463c32c4097e1fe0c3f9ff0e9a03cc3838717ef3771b0cf7b0c9cac4f0e8dcb079
SSDeep 6144:m+tVGBo/EovbDFwk+417EdeWjReJ3yXNjINkDjo7d:m+l/EonFad9jIqDg
TLSH BB943A3B32958F21D2464373C1C7891187E69A8736ABEB0B318513D61D063FEDE4B69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ccd17bd6ab254b13997dca4fee39f230
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Jqx3UCVM5vE5p3YMBH.LiVMdWHNXLooQD4Nie
3ZKCO1GNEH44cDB0cb.6C7sj4OV2c0T1xZhvV
TJK0G8521Cw7wFwMYK.lUAIIMnXEKGZwq4apI
HJ0yMYUwvrrxMi64qk.c4IGXfiuNOuDB6Wioo
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Svbanoppsdw.exe
Full Name
Svbanoppsdw.exe
EntryPoint
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Scope Name
Svbanoppsdw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Svbanoppsdw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
ret <null>
ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
call System.Void n4mLK1J5YgtbqmytC0H::R4RJRIkH0C(n4mLK1J5YgtbqmytC0H)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_22f4e62293e64930a942307471e3e181
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld XdyyuvJVESThAnqogyh XdyyuvJVESThAnqogyh::XMjJHuQwGY
call System.Byte[] XdyyuvJVESThAnqogyh::R4RJRIkH0C(XdyyuvJVESThAnqogyh)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_8868d0a0bced4cb68ab9d2a2bb8b538e
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 7
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_014A: leave IL_0038
ldc.i4 1657497970
ldc.i4 368224571
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_24e4899516a742d588777ed89b47b3c4
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
ldc.i4 2011205249
ldc.i4 522980581
xor <null>
ldc.i4 749998518
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_7f46342b74644e11a5921f850363fc99
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
newobj System.Void Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld TNP95UJQgwvpFEwgIoB TNP95UJQgwvpFEwgIoB::knrJSnTtGN
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P TNP95UJQgwvpFEwgIoB::R4RJRIkH0C(System.Object,System.Byte[],TNP95UJQgwvpFEwgIoB)
ldsfld g7HFcEJw509DX7khNUi g7HFcEJw509DX7khNUi::bamJ3VTXS5
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P g7HFcEJw509DX7khNUi::R4RJRIkH0C(System.Object,g7HFcEJw509DX7khNUi)
ldsfld SHLU4MJkjELcAr7IafV SHLU4MJkjELcAr7IafV::Mj1JjJKBt5
call System.Void SHLU4MJkjELcAr7IafV::R4RJRIkH0C(System.Object,SHLU4MJkjELcAr7IafV)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_972207f2a5754bb98d350f17dfd83969
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_0ae2327122d240e0b559d0562b2e8a1f
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_5197f997b82a4cd08737fb9433b94fcb
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Info
PE Detect: PeReader OK (file layout)
Module Name
Svbanoppsdw.exe
Full Name
Svbanoppsdw.exe
EntryPoint
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Scope Name
Svbanoppsdw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Svbanoppsdw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
ret <null>
ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
call System.Void n4mLK1J5YgtbqmytC0H::R4RJRIkH0C(n4mLK1J5YgtbqmytC0H)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_22f4e62293e64930a942307471e3e181
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld XdyyuvJVESThAnqogyh XdyyuvJVESThAnqogyh::XMjJHuQwGY
call System.Byte[] XdyyuvJVESThAnqogyh::R4RJRIkH0C(XdyyuvJVESThAnqogyh)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_8868d0a0bced4cb68ab9d2a2bb8b538e
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 7
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_014A: leave IL_0038
ldc.i4 1657497970
ldc.i4 368224571
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_24e4899516a742d588777ed89b47b3c4
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
ldc.i4 2011205249
ldc.i4 522980581
xor <null>
ldc.i4 749998518
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_7f46342b74644e11a5921f850363fc99
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
newobj System.Void Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld TNP95UJQgwvpFEwgIoB TNP95UJQgwvpFEwgIoB::knrJSnTtGN
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P TNP95UJQgwvpFEwgIoB::R4RJRIkH0C(System.Object,System.Byte[],TNP95UJQgwvpFEwgIoB)
ldsfld g7HFcEJw509DX7khNUi g7HFcEJw509DX7khNUi::bamJ3VTXS5
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P g7HFcEJw509DX7khNUi::R4RJRIkH0C(System.Object,g7HFcEJw509DX7khNUi)
ldsfld SHLU4MJkjELcAr7IafV SHLU4MJkjELcAr7IafV::Mj1JjJKBt5
call System.Void SHLU4MJkjELcAr7IafV::R4RJRIkH0C(System.Object,SHLU4MJkjELcAr7IafV)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_972207f2a5754bb98d350f17dfd83969
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_0ae2327122d240e0b559d0562b2e8a1f
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_5197f997b82a4cd08737fb9433b94fcb
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
ccd17bd6ab254b13997dca4fee39f230
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Jqx3UCVM5vE5p3YMBH.LiVMdWHNXLooQD4Nie
3ZKCO1GNEH44cDB0cb.6C7sj4OV2c0T1xZhvV
TJK0G8521Cw7wFwMYK.lUAIIMnXEKGZwq4apI
HJ0yMYUwvrrxMi64qk.c4IGXfiuNOuDB6Wioo
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙