Malicious
Malicious

d3adbe59a4100cce52d8c2a1a6f7b0e6

Share on LinkedIn
Print
PE Executable
MD5: d3adbe59a4100cce52d8c2a1a6f7b0e6
Size: 825.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d3adbe59a4100cce52d8c2a1a6f7b0e6
Sha1 3101bd120265e67233ea6296ea13f9f3292cb2b5
Sha256 34b1590817537f05bfa8ce5fc071287780f798e5aa301aaff1a7eadd6569b265
Sha384 3f97f2161ab74afacc1d299e27609d4a0363e4aca3010345a8a422a85e6b8e978b58a0f69ed309d4d2ae9c3d03b8713f
Sha512 29fe5364bede48f3d658e0ec262a7637b8e83d6f992e6061dd68f915978c9eb94f7bbf9dfc15937eb4d2e247638fcee171a010160cc5d34c7066ead05a89b176
SSDeep 12288:Ps7PAyJtHGSdsOv+AQ7h+i5C+yRxTZR3BvX9BcmA3TePdNmsHB:6oSaOZiA3Z3cmxPn1
TLSH 9605AE6A73954E20D2881377C0DB0541C3A5A983BAA7F30E76C423966D433FFDE4A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d3adbe59a4100cce52d8c2a1a6f7b0e6
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
K7i4DYoeVYCcPiqYB9.46l82Wn9kI6A2LX4uL
34kNrBOaq4yf59wq0Q.L4OrCcBSmS4ApuIQ8A
lotGJMcBWSOjk6LH1M.tdfQcg5TxfXxZVRO5K
D6Aul521beABTeLfUD.YidtgAqUk8GqERnR7U
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ureqn.exe
Full Name
Ureqn.exe
EntryPoint
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Scope Name
Ureqn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ureqn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_013F: ret
nop <null>
newobj System.Void Q9esSZuxpLgVPBlwLY.Pmae9M9rLfDGmvJ4MI::.ctor()
ldsfld CqWZcBnl7bj4Zte5hjL CqWZcBnl7bj4Zte5hjL::kG9nYN41ab
call System.Byte[] CqWZcBnl7bj4Zte5hjL::JCCnmrPTPQ(CqWZcBnl7bj4Zte5hjL)
ldsfld dGN6Nbn1AWokA2pHkYc dGN6Nbn1AWokA2pHkYc::SoGnFqAK88
call System.Void dGN6Nbn1AWokA2pHkYc::JCCnmrPTPQ(System.Object,System.Byte[],dGN6Nbn1AWokA2pHkYc)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_ecb86430f87044659443630fe17d5438
brtrue IL_0083: switch(IL_009F)
pop <null>
ldc.i4 0
br IL_0083: switch(IL_009F)
br IL_007F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_007F: ldloc V_1
br IL_009F: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_4be271f049594c55a9aa65d1e556ef96
brfalse IL_00D6: switch(IL_00F2)
pop <null>
ldc.i4 0
br IL_00D6: switch(IL_00F2)
br IL_00D2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D2: ldloc V_2
br IL_00F2: leave IL_013F
leave IL_013F: ret
ldc.i4 2
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_3f0814791d7b4358b49336ae98e60464
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ldsfld LauhcLn0rlomqjB4m33 LauhcLn0rlomqjB4m33::uvbnt2sPGy
call System.Void LauhcLn0rlomqjB4m33::JCCnmrPTPQ(LauhcLn0rlomqjB4m33)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_d626b2334d1c46d4ae6d549164daa913
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ret <null>
Module Name
Ureqn.exe
Full Name
Ureqn.exe
EntryPoint
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Scope Name
Ureqn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ureqn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void twnmkYvChGGl83Vnih.AdikquToGuFli6n2RE::iR66fpIeK()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_013F: ret
nop <null>
newobj System.Void Q9esSZuxpLgVPBlwLY.Pmae9M9rLfDGmvJ4MI::.ctor()
ldsfld CqWZcBnl7bj4Zte5hjL CqWZcBnl7bj4Zte5hjL::kG9nYN41ab
call System.Byte[] CqWZcBnl7bj4Zte5hjL::JCCnmrPTPQ(CqWZcBnl7bj4Zte5hjL)
ldsfld dGN6Nbn1AWokA2pHkYc dGN6Nbn1AWokA2pHkYc::SoGnFqAK88
call System.Void dGN6Nbn1AWokA2pHkYc::JCCnmrPTPQ(System.Object,System.Byte[],dGN6Nbn1AWokA2pHkYc)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_ecb86430f87044659443630fe17d5438
brtrue IL_0083: switch(IL_009F)
pop <null>
ldc.i4 0
br IL_0083: switch(IL_009F)
br IL_007F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_007F: ldloc V_1
br IL_009F: leave IL_013F
leave IL_013F: ret
pop <null>
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_4be271f049594c55a9aa65d1e556ef96
brfalse IL_00D6: switch(IL_00F2)
pop <null>
ldc.i4 0
br IL_00D6: switch(IL_00F2)
br IL_00D2: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D2: ldloc V_2
br IL_00F2: leave IL_013F
leave IL_013F: ret
ldc.i4 2
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_3f0814791d7b4358b49336ae98e60464
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 7
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ldsfld LauhcLn0rlomqjB4m33 LauhcLn0rlomqjB4m33::uvbnt2sPGy
call System.Void LauhcLn0rlomqjB4m33::JCCnmrPTPQ(LauhcLn0rlomqjB4m33)
ldc.i4 0
ldsfld <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407} <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_b0510d034b5d4622a627ac7b22ea456e
ldfld System.Int32 <Module>{5498d2ae-ef23-495b-8c4a-495f72fab407}::m_d626b2334d1c46d4ae6d549164daa913
brtrue IL_0014: switch(IL_0038,IL_0116,IL_013F)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0116,IL_013F)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙