Malicious
Malicious

ccd17bd6ab254b13997dca4fee39f230

Share on LinkedIn
Print
PE Executable
MD5: ccd17bd6ab254b13997dca4fee39f230
Size: 428.54 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 ccd17bd6ab254b13997dca4fee39f230
Sha1 a426c93c2526a2cdd21f7ed77596f6fd83449df0
Sha256 2dade2f99d5058f68c38d45e07e0d3f5ad2574e1aeb9eeeac32d93027f6c5624
Sha384 fd0b064d7e5dfbe7eaa824ae5d4475c80ce502591be56bcf5c87a502b125fc752b12f8473f91ddeaa9c3a3c2e6d7a339
Sha512 044221c0d944ce38ca7cdd6683a33b1562dc2bf669f09ac9f2d4edb8b0f12d463c32c4097e1fe0c3f9ff0e9a03cc3838717ef3771b0cf7b0c9cac4f0e8dcb079
SSDeep 6144:m+tVGBo/EovbDFwk+417EdeWjReJ3yXNjINkDjo7d:m+l/EonFad9jIqDg
TLSH BB943A3B32958F21D2464373C1C7891187E69A8736ABEB0B318513D61D063FEDE4B69B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ccd17bd6ab254b13997dca4fee39f230
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Jqx3UCVM5vE5p3YMBH.LiVMdWHNXLooQD4Nie
3ZKCO1GNEH44cDB0cb.6C7sj4OV2c0T1xZhvV
TJK0G8521Cw7wFwMYK.lUAIIMnXEKGZwq4apI
HJ0yMYUwvrrxMi64qk.c4IGXfiuNOuDB6Wioo
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Svbanoppsdw.exe
Full Name
Svbanoppsdw.exe
EntryPoint
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Scope Name
Svbanoppsdw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Svbanoppsdw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
ret <null>
ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
call System.Void n4mLK1J5YgtbqmytC0H::R4RJRIkH0C(n4mLK1J5YgtbqmytC0H)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_22f4e62293e64930a942307471e3e181
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld XdyyuvJVESThAnqogyh XdyyuvJVESThAnqogyh::XMjJHuQwGY
call System.Byte[] XdyyuvJVESThAnqogyh::R4RJRIkH0C(XdyyuvJVESThAnqogyh)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_8868d0a0bced4cb68ab9d2a2bb8b538e
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 7
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_014A: leave IL_0038
ldc.i4 1657497970
ldc.i4 368224571
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_24e4899516a742d588777ed89b47b3c4
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
ldc.i4 2011205249
ldc.i4 522980581
xor <null>
ldc.i4 749998518
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_7f46342b74644e11a5921f850363fc99
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
newobj System.Void Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld TNP95UJQgwvpFEwgIoB TNP95UJQgwvpFEwgIoB::knrJSnTtGN
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P TNP95UJQgwvpFEwgIoB::R4RJRIkH0C(System.Object,System.Byte[],TNP95UJQgwvpFEwgIoB)
ldsfld g7HFcEJw509DX7khNUi g7HFcEJw509DX7khNUi::bamJ3VTXS5
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P g7HFcEJw509DX7khNUi::R4RJRIkH0C(System.Object,g7HFcEJw509DX7khNUi)
ldsfld SHLU4MJkjELcAr7IafV SHLU4MJkjELcAr7IafV::Mj1JjJKBt5
call System.Void SHLU4MJkjELcAr7IafV::R4RJRIkH0C(System.Object,SHLU4MJkjELcAr7IafV)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_972207f2a5754bb98d350f17dfd83969
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_0ae2327122d240e0b559d0562b2e8a1f
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_5197f997b82a4cd08737fb9433b94fcb
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Info
PE Detect: PeReader OK (file layout)
Module Name
Svbanoppsdw.exe
Full Name
Svbanoppsdw.exe
EntryPoint
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Scope Name
Svbanoppsdw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Svbanoppsdw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hMtd7cpV2muuP1Lfrs.XdtUMEJhyva1eCuN7A::BNUQmLgHH()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
ret <null>
ldsfld n4mLK1J5YgtbqmytC0H n4mLK1J5YgtbqmytC0H::FqCJnyao7u
call System.Void n4mLK1J5YgtbqmytC0H::R4RJRIkH0C(n4mLK1J5YgtbqmytC0H)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_22f4e62293e64930a942307471e3e181
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 6
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld XdyyuvJVESThAnqogyh XdyyuvJVESThAnqogyh::XMjJHuQwGY
call System.Byte[] XdyyuvJVESThAnqogyh::R4RJRIkH0C(XdyyuvJVESThAnqogyh)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_8868d0a0bced4cb68ab9d2a2bb8b538e
brfalse IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 7
br IL_00A0: switch(IL_014A,IL_00C0)
br IL_009C: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_009C: ldloc V_1
br IL_014A: leave IL_0038
ldc.i4 1657497970
ldc.i4 368224571
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_24e4899516a742d588777ed89b47b3c4
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
ldc.i4 2011205249
ldc.i4 522980581
xor <null>
ldc.i4 749998518
xor <null>
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_7f46342b74644e11a5921f850363fc99
xor <null>
ldsfld OAkyiqJJkqeaKcVfMD4 OAkyiqJJkqeaKcVfMD4::BwsJpWmLSC
call System.String OAkyiqJJkqeaKcVfMD4::R4RJRIkH0C(System.Int32,OAkyiqJJkqeaKcVfMD4)
newobj System.Void Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld TNP95UJQgwvpFEwgIoB TNP95UJQgwvpFEwgIoB::knrJSnTtGN
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P TNP95UJQgwvpFEwgIoB::R4RJRIkH0C(System.Object,System.Byte[],TNP95UJQgwvpFEwgIoB)
ldsfld g7HFcEJw509DX7khNUi g7HFcEJw509DX7khNUi::bamJ3VTXS5
call Tu3jEAU9RpxooeZWnWQ.bB4LjQURNqB2NWsGB2P g7HFcEJw509DX7khNUi::R4RJRIkH0C(System.Object,g7HFcEJw509DX7khNUi)
ldsfld SHLU4MJkjELcAr7IafV SHLU4MJkjELcAr7IafV::Mj1JjJKBt5
call System.Void SHLU4MJkjELcAr7IafV::R4RJRIkH0C(System.Object,SHLU4MJkjELcAr7IafV)
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_972207f2a5754bb98d350f17dfd83969
brtrue IL_00A0: switch(IL_014A,IL_00C0)
pop <null>
ldc.i4 2
br IL_00A0: switch(IL_014A,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_0ae2327122d240e0b559d0562b2e8a1f
brfalse IL_0181: switch(IL_019D)
pop <null>
ldc.i4 0
br IL_0181: switch(IL_019D)
br IL_017D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_017D: ldloc V_3
br IL_019D: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f} <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_ed7fc13435fc4e5c98e75b74c591b2be
ldfld System.Int32 <Module>{b8842dc6-542c-4694-ade1-142aa2e2179f}::m_5197f997b82a4cd08737fb9433b94fcb
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙