d3ee116e4d0edf012d7523cdfef1e6b8

PE Executable

MD5: d3ee116e4d0edf012d7523cdfef1e6b8

Size: 964.1 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	d3ee116e4d0edf012d7523cdfef1e6b8
Sha1	512ad62dbd39403f43ebdd925cdf10662a79ae59
Sha256	ee173fe306d7834864d41b0d02327027a736c2f8517a6831da52b1b30e9a0d72
Sha384	6a3476ac5469c0261cce7d7cc479bdc4f272c0ca9b7aeeb548840a70613bbd1086a8dffe37469e22ea18f7caf5c23a22
Sha512	af260f628c087bc233e8f3c66cc37b4beb9bfca227ed9353df7c7f2686b6a2e6fecd9903122e4a311315b9b0e6971025e78b7164cfb5e6dc6b89179d4caa33f9
SSDeep	12288:amMT+n9Vu56SZzpX8zmqKZMyonzARa3AjhzWCQHDtgho8GT0jCUF44NvvDvSB6kh:amM23DKX8Dw60bdeghTGTw4qvvDvU6k
TLSH	6A25BEAA3ADEC82AF0721E70C4A1F2F247B0AD81E621C247DAD57DD77931F80568535B

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	nhBU.exe
Full Name	nhBU.exe
EntryPoint	System.Void iF7.wFD::kFx()
Scope Name	nhBU.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	nhBU
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	741
Main Method	System.Void iF7.wFD::kFx()
Main IL Instruction Count	18
Main IL	nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_000B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0036: call System.Void M3r.B3N::Nbb() nop <null> newobj System.Void gM.rR::.ctor() stsfld gM.rR iF7.wFD::J30 br IL_0027: ldsfld gM.rR iF7.wFD::J30 ldsfld gM.rR iF7.wFD::J30 call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0040: nop call System.Void M3r.B3N::Nbb() br IL_0017: nop nop <null> ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	nhBU.exe
Full Name	nhBU.exe
EntryPoint	System.Void iF7.wFD::kFx()
Scope Name	nhBU.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	nhBU
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Total Strings	741
Main Method	System.Void iF7.wFD::kFx()
Main IL Instruction Count	18
Main IL	nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() br IL_000B: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0036: call System.Void M3r.B3N::Nbb() nop <null> newobj System.Void gM.rR::.ctor() stsfld gM.rR iF7.wFD::J30 br IL_0027: ldsfld gM.rR iF7.wFD::J30 ldsfld gM.rR iF7.wFD::J30 call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_0040: nop call System.Void M3r.B3N::Nbb() br IL_0017: nop nop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.