Suspicious
Suspect

da90fd74d3033e19b43c7bf0c9a9eec0

PE Executable
MD5: da90fd74d3033e19b43c7bf0c9a9eec0
Size: 1.03 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 da90fd74d3033e19b43c7bf0c9a9eec0
Sha1 dd5b0cb474bef398e49423fe6b83713834232439
Sha256 151b01ecbb7aca8b8a3e82f2e74c4f496e95046b89601a2482e6dcb3d570d78c
Sha384 1649a9d5b9e602ea97535fd296341a4e232208a7d570f841ac80f9d6297d0e0de803d224c12a3a4d7c7eff2373f59a22
Sha512 0df4752aa2faf8a8722a23f86fb199b8b7e295efe0db795b6eafbb6e62ec40fe2b623df9ad9e09b9d4a0d8388f36ef5fb65c5ec8fc43fae956ddae0f521ae62f
SSDeep 24576:S+4S39HMJU3YORunWhm60XybH350qIno0GYb:S+b3eJUDYnWY60K5Mj
TLSH 772501262E83BB40D7780F3DC162149853F4D21B5222F7AA1EFE02F44E57F6D9A2745A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
da90fd74d3033e19b43c7bf0c9a9eec0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
7BdzPf9ao6Qs.Resources.resources
7BdzPf9ao6Qs.g.resources
2c5a060edb5ea6.Resources.resources
28eb2ced0
[NBF]root.Data
28eb2ced1
[NBF]root.Data
28eb2ced10
[NBF]root.Data
28eb2ced11
[NBF]root.Data
28eb2ced12
[NBF]root.Data
28eb2ced13
[NBF]root.Data
28eb2ced14
[NBF]root.Data
28eb2ced15
[NBF]root.Data
28eb2ced16
[NBF]root.Data
28eb2ced17
[NBF]root.Data
28eb2ced18
[NBF]root.Data
28eb2ced19
[NBF]root.Data
28eb2ced2
[NBF]root.Data
28eb2ced20
[NBF]root.Data
28eb2ced21
[NBF]root.Data
28eb2ced22
[NBF]root.Data
28eb2ced3
[NBF]root.Data
28eb2ced4
[NBF]root.Data
28eb2ced5
[NBF]root.Data
28eb2ced6
[NBF]root.Data
28eb2ced7
[NBF]root.Data
28eb2ced8
[NBF]root.Data
28eb2ced9
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
7BdzPf9ao6Qs
Full Name
7BdzPf9ao6Qs
EntryPoint
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Scope Name
7BdzPf9ao6Qs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7BdzPf9ao6Qs
Assembly Version
1.27.16.66
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Main IL Instruction Count
125
Main IL 
nop <null>
br.s IL_0003: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0043: nop
nop <null>
ldloc.0 <null>
newobj System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::.ctor(ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Fot93Bqoq0Cc
ldloc.0 <null>
ldnull <null>
stfld System.Object[] ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Pz0t5Gsoyd8Z
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0006: ldloc.s V_4
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Kx6of1iY0
ldloc.0 <null>
newobj System.Void System.Collections.Generic.Stack`1<System.Action>::.ctor()
stfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::5sxHK8d_zG7()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.s 9
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::pb2PHfy91Qk_Wd()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Mkb0jz6()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.1 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::wk5Gz0XcWr1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldnull <null>
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldc.i4.s 11
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::aXd8_4PfWj0g9D()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.3 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Action System.Collections.Generic.Stack`1<System.Action>::Pop()
callvirt System.Void System.Action::Invoke()
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Int32 System.Collections.Generic.Stack`1<System.Action>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0159: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0152: stloc.s V_4
leave.s IL_0171: br.s IL_0173
br.s IL_0160: br.s IL_0162
br.s IL_0162: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0171: br.s IL_0173
br.s IL_0173: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0193: nop
nop <null>
ret <null>
ldtoken System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
pop <null>
ret <null>
Module Name
7BdzPf9ao6Qs
Full Name
7BdzPf9ao6Qs
EntryPoint
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Scope Name
7BdzPf9ao6Qs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7BdzPf9ao6Qs
Assembly Version
1.27.16.66
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Main IL Instruction Count
125
Main IL 
nop <null>
br.s IL_0003: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0043: nop
nop <null>
ldloc.0 <null>
newobj System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::.ctor(ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Fot93Bqoq0Cc
ldloc.0 <null>
ldnull <null>
stfld System.Object[] ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Pz0t5Gsoyd8Z
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0006: ldloc.s V_4
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Kx6of1iY0
ldloc.0 <null>
newobj System.Void System.Collections.Generic.Stack`1<System.Action>::.ctor()
stfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::5sxHK8d_zG7()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.s 9
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::pb2PHfy91Qk_Wd()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Mkb0jz6()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.1 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::wk5Gz0XcWr1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldnull <null>
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldc.i4.s 11
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::aXd8_4PfWj0g9D()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.3 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Action System.Collections.Generic.Stack`1<System.Action>::Pop()
callvirt System.Void System.Action::Invoke()
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Int32 System.Collections.Generic.Stack`1<System.Action>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0159: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0152: stloc.s V_4
leave.s IL_0171: br.s IL_0173
br.s IL_0160: br.s IL_0162
br.s IL_0162: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0171: br.s IL_0173
br.s IL_0173: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0193: nop
nop <null>
ret <null>
ldtoken System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
pop <null>
ret <null>
da90fd74d3033e19b43c7bf0c9a9eec0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
7BdzPf9ao6Qs.Resources.resources
7BdzPf9ao6Qs.g.resources
2c5a060edb5ea6.Resources.resources
28eb2ced0
[NBF]root.Data
28eb2ced1
[NBF]root.Data
28eb2ced10
[NBF]root.Data
28eb2ced11
[NBF]root.Data
28eb2ced12
[NBF]root.Data
28eb2ced13
[NBF]root.Data
28eb2ced14
[NBF]root.Data
28eb2ced15
[NBF]root.Data
28eb2ced16
[NBF]root.Data
28eb2ced17
[NBF]root.Data
28eb2ced18
[NBF]root.Data
28eb2ced19
[NBF]root.Data
28eb2ced2
[NBF]root.Data
28eb2ced20
[NBF]root.Data
28eb2ced21
[NBF]root.Data
28eb2ced22
[NBF]root.Data
28eb2ced3
[NBF]root.Data
28eb2ced4
[NBF]root.Data
28eb2ced5
[NBF]root.Data
28eb2ced6
[NBF]root.Data
28eb2ced7
[NBF]root.Data
28eb2ced8
[NBF]root.Data
28eb2ced9
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙