Suspicious
Suspect

da90fd74d3033e19b43c7bf0c9a9eec0

Share on LinkedIn
Print
PE Executable
MD5: da90fd74d3033e19b43c7bf0c9a9eec0
Size: 1.03 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 da90fd74d3033e19b43c7bf0c9a9eec0
Sha1 dd5b0cb474bef398e49423fe6b83713834232439
Sha256 151b01ecbb7aca8b8a3e82f2e74c4f496e95046b89601a2482e6dcb3d570d78c
Sha384 1649a9d5b9e602ea97535fd296341a4e232208a7d570f841ac80f9d6297d0e0de803d224c12a3a4d7c7eff2373f59a22
Sha512 0df4752aa2faf8a8722a23f86fb199b8b7e295efe0db795b6eafbb6e62ec40fe2b623df9ad9e09b9d4a0d8388f36ef5fb65c5ec8fc43fae956ddae0f521ae62f
SSDeep 24576:S+4S39HMJU3YORunWhm60XybH350qIno0GYb:S+b3eJUDYnWY60K5Mj
TLSH 772501262E83BB40D7780F3DC162149853F4D21B5222F7AA1EFE02F44E57F6D9A2745A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
da90fd74d3033e19b43c7bf0c9a9eec0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
7BdzPf9ao6Qs.Resources.resources
7BdzPf9ao6Qs.g.resources
2c5a060edb5ea6.Resources.resources
28eb2ced0
[NBF]root.Data
28eb2ced1
[NBF]root.Data
28eb2ced10
[NBF]root.Data
28eb2ced11
[NBF]root.Data
28eb2ced12
[NBF]root.Data
28eb2ced13
[NBF]root.Data
28eb2ced14
[NBF]root.Data
28eb2ced15
[NBF]root.Data
28eb2ced16
[NBF]root.Data
28eb2ced17
[NBF]root.Data
28eb2ced18
[NBF]root.Data
28eb2ced19
[NBF]root.Data
28eb2ced2
[NBF]root.Data
28eb2ced20
[NBF]root.Data
28eb2ced21
[NBF]root.Data
28eb2ced22
[NBF]root.Data
28eb2ced3
[NBF]root.Data
28eb2ced4
[NBF]root.Data
28eb2ced5
[NBF]root.Data
28eb2ced6
[NBF]root.Data
28eb2ced7
[NBF]root.Data
28eb2ced8
[NBF]root.Data
28eb2ced9
[NBF]root.Data
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
7BdzPf9ao6Qs
Full Name
7BdzPf9ao6Qs
EntryPoint
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Scope Name
7BdzPf9ao6Qs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7BdzPf9ao6Qs
Assembly Version
1.27.16.66
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Main IL Instruction Count
125
Main IL 
nop <null>
br.s IL_0003: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0043: nop
nop <null>
ldloc.0 <null>
newobj System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::.ctor(ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Fot93Bqoq0Cc
ldloc.0 <null>
ldnull <null>
stfld System.Object[] ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Pz0t5Gsoyd8Z
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0006: ldloc.s V_4
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Kx6of1iY0
ldloc.0 <null>
newobj System.Void System.Collections.Generic.Stack`1<System.Action>::.ctor()
stfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::5sxHK8d_zG7()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.s 9
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::pb2PHfy91Qk_Wd()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Mkb0jz6()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.1 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::wk5Gz0XcWr1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldnull <null>
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldc.i4.s 11
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::aXd8_4PfWj0g9D()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.3 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Action System.Collections.Generic.Stack`1<System.Action>::Pop()
callvirt System.Void System.Action::Invoke()
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Int32 System.Collections.Generic.Stack`1<System.Action>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0159: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0152: stloc.s V_4
leave.s IL_0171: br.s IL_0173
br.s IL_0160: br.s IL_0162
br.s IL_0162: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0171: br.s IL_0173
br.s IL_0173: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0193: nop
nop <null>
ret <null>
ldtoken System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
pop <null>
ret <null>
Module Name
7BdzPf9ao6Qs
Full Name
7BdzPf9ao6Qs
EntryPoint
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Scope Name
7BdzPf9ao6Qs
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
7BdzPf9ao6Qs
Assembly Version
1.27.16.66
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
Main IL Instruction Count
125
Main IL 
nop <null>
br.s IL_0003: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0043: nop
nop <null>
ldloc.0 <null>
newobj System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::.ctor(ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Fot93Bqoq0Cc
ldloc.0 <null>
ldnull <null>
stfld System.Object[] ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Pz0t5Gsoyd8Z
ldc.i4.7 <null>
stloc.s V_4
br.s IL_0006: ldloc.s V_4
ldloc.0 <null>
ldc.i4.0 <null>
stfld System.Int32 ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Kx6of1iY0
ldloc.0 <null>
newobj System.Void System.Collections.Generic.Stack`1<System.Action>::.ctor()
stfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::5sxHK8d_zG7()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.s 9
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::pb2PHfy91Qk_Wd()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::Mkb0jz6()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.1 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::wk5Gz0XcWr1()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
nop <null>
ldloc.0 <null>
ldnull <null>
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldc.i4.s 11
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldloc.0 <null>
ldftn System.Void ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::aXd8_4PfWj0g9D()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
stfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
ldloc.0 <null>
ldfld System.Action ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::0Ybst1Pqsd
callvirt System.Void System.Collections.Generic.Stack`1<System.Action>::Push(System.Action)
ldc.i4.3 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Action System.Collections.Generic.Stack`1<System.Action>::Pop()
callvirt System.Void System.Action::Invoke()
nop <null>
nop <null>
ldc.i4.4 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldloc.0 <null>
ldfld System.Collections.Generic.Stack`1<System.Action> ee6ZTxj13kRp.At1r9Qz/gEs1C6.nHt63::6bdQYw5
callvirt System.Int32 System.Collections.Generic.Stack`1<System.Action>::get_Count()
ldc.i4.0 <null>
cgt <null>
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0159: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_4
br IL_0006: ldloc.s V_4
ldc.i4.5 <null>
br.s IL_0152: stloc.s V_4
leave.s IL_0171: br.s IL_0173
br.s IL_0160: br.s IL_0162
br.s IL_0162: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0171: br.s IL_0173
br.s IL_0173: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0193: nop
nop <null>
ret <null>
ldtoken System.Void ee6ZTxj13kRp.At1r9Qz::5Zxbw9cSqM()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙