Malicious
Malicious

d3adbe59a4100cce52d8c2a1a6f7b0e6

PE Executable
MD5: d3adbe59a4100cce52d8c2a1a6f7b0e6
Size: 825.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d3adbe59a4100cce52d8c2a1a6f7b0e6
Sha1 3101bd120265e67233ea6296ea13f9f3292cb2b5
Sha256 34b1590817537f05bfa8ce5fc071287780f798e5aa301aaff1a7eadd6569b265
Sha384 3f97f2161ab74afacc1d299e27609d4a0363e4aca3010345a8a422a85e6b8e978b58a0f69ed309d4d2ae9c3d03b8713f
Sha512 29fe5364bede48f3d658e0ec262a7637b8e83d6f992e6061dd68f915978c9eb94f7bbf9dfc15937eb4d2e247638fcee171a010160cc5d34c7066ead05a89b176
SSDeep 12288:Ps7PAyJtHGSdsOv+AQ7h+i5C+yRxTZR3BvX9BcmA3TePdNmsHB:6oSaOZiA3Z3cmxPn1
TLSH 9605AE6A73954E20D2881377C0DB0541C3A5A983BAA7F30E76C423966D433FFDE4A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d3adbe59a4100cce52d8c2a1a6f7b0e6
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
K7i4DYoeVYCcPiqYB9.46l82Wn9kI6A2LX4uL
34kNrBOaq4yf59wq0Q.L4OrCcBSmS4ApuIQ8A
lotGJMcBWSOjk6LH1M.tdfQcg5TxfXxZVRO5K
D6Aul521beABTeLfUD.YidtgAqUk8GqERnR7U
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ureqn.exe
Full Name
Ureqn.exe
EntryPoint
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Scope Name
Ureqn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ureqn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_013F: ret
nop <null>
newobj System.Void Q9esSZuxpLgVPBlwLY.Pmae9M9rLfDGmvJ4MI::.ctor()
ldsfld CqWZcBnl7bj4Zte5hjL CqWZcBnl7bj4Zte5hjL::kG9nYN41ab
call System.Byte[] CqWZcBnl7bj4Zte5hjL::JCCnmrPTPQ(CqWZcBnl7bj4Zte5hjL)
ldsfld dGN6Nbn1AWokA2pHkYc dGN6Nbn1AWokA2pHkYc::SoGnFqAK88
call System.Void dGN6Nbn1AWokA2pHkYc::JCCnmrPTPQ(System.Object,System.Byte[],dGN6Nbn1AWokA2pHkYc)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_ecb86430f87044659443630fe17d5438
brtrue IL_0083: switch(IL_009F)
pop <null>
ldc.i4 0
br IL_0083: switch(IL_009F)
br IL_007F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_007F: ldloc V_1
br IL_009F: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_4be271f049594c55a9aa65d1e556ef96
brfalse IL_00D6: switch(IL_00F2)
pop <null>
ldc.i4 0
br IL_00D6: switch(IL_00F2)
br IL_00D2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D2: ldloc V_2
br IL_00F2: leave IL_013F
leave IL_013F: ret
ldc.i4 2
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_3f0814791d7b4358b49336ae98e60464
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ldsfld LauhcLn0rlomqjB4m33 LauhcLn0rlomqjB4m33::uvbnt2sPGy
call System.Void LauhcLn0rlomqjB4m33::JCCnmrPTPQ(LauhcLn0rlomqjB4m33)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_d626b2334d1c46d4ae6d549164daa913
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ret <null>
Module Name
Ureqn.exe
Full Name
Ureqn.exe
EntryPoint
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Scope Name
Ureqn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ureqn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_013F: ret
nop <null>
newobj System.Void Q9esSZuxpLgVPBlwLY.Pmae9M9rLfDGmvJ4MI::.ctor()
ldsfld CqWZcBnl7bj4Zte5hjL CqWZcBnl7bj4Zte5hjL::kG9nYN41ab
call System.Byte[] CqWZcBnl7bj4Zte5hjL::JCCnmrPTPQ(CqWZcBnl7bj4Zte5hjL)
ldsfld dGN6Nbn1AWokA2pHkYc dGN6Nbn1AWokA2pHkYc::SoGnFqAK88
call System.Void dGN6Nbn1AWokA2pHkYc::JCCnmrPTPQ(System.Object,System.Byte[],dGN6Nbn1AWokA2pHkYc)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_ecb86430f87044659443630fe17d5438
brtrue IL_0083: switch(IL_009F)
pop <null>
ldc.i4 0
br IL_0083: switch(IL_009F)
br IL_007F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_007F: ldloc V_1
br IL_009F: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_4be271f049594c55a9aa65d1e556ef96
brfalse IL_00D6: switch(IL_00F2)
pop <null>
ldc.i4 0
br IL_00D6: switch(IL_00F2)
br IL_00D2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D2: ldloc V_2
br IL_00F2: leave IL_013F
leave IL_013F: ret
ldc.i4 2
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_3f0814791d7b4358b49336ae98e60464
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ldsfld LauhcLn0rlomqjB4m33 LauhcLn0rlomqjB4m33::uvbnt2sPGy
call System.Void LauhcLn0rlomqjB4m33::JCCnmrPTPQ(LauhcLn0rlomqjB4m33)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_d626b2334d1c46d4ae6d549164daa913
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ret <null>
d3adbe59a4100cce52d8c2a1a6f7b0e6
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
K7i4DYoeVYCcPiqYB9.46l82Wn9kI6A2LX4uL
34kNrBOaq4yf59wq0Q.L4OrCcBSmS4ApuIQ8A
lotGJMcBWSOjk6LH1M.tdfQcg5TxfXxZVRO5K
D6Aul521beABTeLfUD.YidtgAqUk8GqERnR7U
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙