Malicious
Malicious

dcb6399c2a8ef6fe03d6ca0670268591

PE Executable
MD5: dcb6399c2a8ef6fe03d6ca0670268591
Size: 423.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 dcb6399c2a8ef6fe03d6ca0670268591
Sha1 9edd377b19f00ec2a849e180c8cc49c9f65dd988
Sha256 21ab822206407d6bc66d1a2a0f81262e20274368d4eaea3f60ccc2753aaedd88
Sha384 b3483497c9d6ea086099d44b5c65f13544d06e79cead95d1a7b5a89db7772850dbba14e890cde204bba08a9952d72d57
Sha512 b8ec32fe46623b0a5c741044af2dfc3240d6e62ce7e1919bbf4d97fd86388b496583c32387c9038ac269509e91231ded13a4077d261eddd1ccda6469053acc95
SSDeep 6144:tQGi6rZvFmr2b3RjFIx0Wm1rYVfnoJZYq:CCrPmrIj40zYVvosq
TLSH BB94293B36998E25C2465372C1C7494087E79A476BABF70F358413DA2D033EEDA4A397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
dcb6399c2a8ef6fe03d6ca0670268591
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YDdwv04AtJSSF1fmJC.hUD7sqt6JXMGcU4aFN
SmjXUZgfK6fmgyTSfT.Aae8HqfJJFmwyTQstY
xuPAOKspkHZVu4nHdk.FWNSw66Ndrhg68v0LI
6Zdfv0wAjt2qFuVfWc.QjrbloNYMffAiyVaS3
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Gqrjfqf.exe
Full Name
Gqrjfqf.exe
EntryPoint
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Scope Name
Gqrjfqf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gqrjfqf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: nop
ret <null>
nop <null>
ldsfld xL0wqAPsHGTP2Gj8BZr xL0wqAPsHGTP2Gj8BZr::pkLP6r5Bq6
call System.Byte[] xL0wqAPsHGTP2Gj8BZr::BYtPjWTxVZ(xL0wqAPsHGTP2Gj8BZr)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_e930f94ff8dd4a0199017de0bc837e89
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0122)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0122: leave IL_0038
ldc.i4 -490775056
neg <null>
ldc.i4 713227507
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_3f378f7d407b4d078d09045385c32996
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
ldc.i4 -2107181193
ldc.i4 -536033297
xor <null>
ldc.i4 1912091582
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_928f03e3899e40658d93ff907445c157
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
newobj System.Void oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld rseHZDPL2YGHHXmsZks rseHZDPL2YGHHXmsZks::ROgPrUnL3R
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c rseHZDPL2YGHHXmsZks::BYtPjWTxVZ(System.Object,System.Byte[],rseHZDPL2YGHHXmsZks)
ldsfld gem6Y0P0cPtsf7NUgyD gem6Y0P0cPtsf7NUgyD::hU4PhZayqv
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c gem6Y0P0cPtsf7NUgyD::BYtPjWTxVZ(System.Object,gem6Y0P0cPtsf7NUgyD)
ldsfld Ic4rH7P8QSbNMJZox6I Ic4rH7P8QSbNMJZox6I::HFxPDpch0R
call System.Void Ic4rH7P8QSbNMJZox6I::BYtPjWTxVZ(System.Object,Ic4rH7P8QSbNMJZox6I)
ldc.i4 3
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_60083b5a3fcc46e7bca1d0f3eded0a7a
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0122)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_c08322460da9444589b9f443b26b669b
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 0
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0155: ldloc V_0
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b911890bbb3d41b2afc7e90a63390f67
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld ouJuMmP4ianlp8JktNN ouJuMmP4ianlp8JktNN::HdvPt2egpm
call System.Void ouJuMmP4ianlp8JktNN::BYtPjWTxVZ(ouJuMmP4ianlp8JktNN)
ldc.i4 1
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b94f4dab1b834f4e8a6f88826632db29
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
Module Name
Gqrjfqf.exe
Full Name
Gqrjfqf.exe
EntryPoint
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Scope Name
Gqrjfqf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gqrjfqf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: nop
ret <null>
nop <null>
ldsfld xL0wqAPsHGTP2Gj8BZr xL0wqAPsHGTP2Gj8BZr::pkLP6r5Bq6
call System.Byte[] xL0wqAPsHGTP2Gj8BZr::BYtPjWTxVZ(xL0wqAPsHGTP2Gj8BZr)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_e930f94ff8dd4a0199017de0bc837e89
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0122)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0122: leave IL_0038
ldc.i4 -490775056
neg <null>
ldc.i4 713227507
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_3f378f7d407b4d078d09045385c32996
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
ldc.i4 -2107181193
ldc.i4 -536033297
xor <null>
ldc.i4 1912091582
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_928f03e3899e40658d93ff907445c157
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
newobj System.Void oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld rseHZDPL2YGHHXmsZks rseHZDPL2YGHHXmsZks::ROgPrUnL3R
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c rseHZDPL2YGHHXmsZks::BYtPjWTxVZ(System.Object,System.Byte[],rseHZDPL2YGHHXmsZks)
ldsfld gem6Y0P0cPtsf7NUgyD gem6Y0P0cPtsf7NUgyD::hU4PhZayqv
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c gem6Y0P0cPtsf7NUgyD::BYtPjWTxVZ(System.Object,gem6Y0P0cPtsf7NUgyD)
ldsfld Ic4rH7P8QSbNMJZox6I Ic4rH7P8QSbNMJZox6I::HFxPDpch0R
call System.Void Ic4rH7P8QSbNMJZox6I::BYtPjWTxVZ(System.Object,Ic4rH7P8QSbNMJZox6I)
ldc.i4 3
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_60083b5a3fcc46e7bca1d0f3eded0a7a
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0122)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_c08322460da9444589b9f443b26b669b
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 0
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0155: ldloc V_0
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b911890bbb3d41b2afc7e90a63390f67
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld ouJuMmP4ianlp8JktNN ouJuMmP4ianlp8JktNN::HdvPt2egpm
call System.Void ouJuMmP4ianlp8JktNN::BYtPjWTxVZ(ouJuMmP4ianlp8JktNN)
ldc.i4 1
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b94f4dab1b834f4e8a6f88826632db29
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
dcb6399c2a8ef6fe03d6ca0670268591
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YDdwv04AtJSSF1fmJC.hUD7sqt6JXMGcU4aFN
SmjXUZgfK6fmgyTSfT.Aae8HqfJJFmwyTQstY
xuPAOKspkHZVu4nHdk.FWNSw66Ndrhg68v0LI
6Zdfv0wAjt2qFuVfWc.QjrbloNYMffAiyVaS3
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙