Malicious
Malicious

dcb6399c2a8ef6fe03d6ca0670268591

Share on LinkedIn
Print
PE Executable
MD5: dcb6399c2a8ef6fe03d6ca0670268591
Size: 423.94 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 dcb6399c2a8ef6fe03d6ca0670268591
Sha1 9edd377b19f00ec2a849e180c8cc49c9f65dd988
Sha256 21ab822206407d6bc66d1a2a0f81262e20274368d4eaea3f60ccc2753aaedd88
Sha384 b3483497c9d6ea086099d44b5c65f13544d06e79cead95d1a7b5a89db7772850dbba14e890cde204bba08a9952d72d57
Sha512 b8ec32fe46623b0a5c741044af2dfc3240d6e62ce7e1919bbf4d97fd86388b496583c32387c9038ac269509e91231ded13a4077d261eddd1ccda6469053acc95
SSDeep 6144:tQGi6rZvFmr2b3RjFIx0Wm1rYVfnoJZYq:CCrPmrIj40zYVvosq
TLSH BB94293B36998E25C2465372C1C7494087E79A476BABF70F358413DA2D033EEDA4A397
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
dcb6399c2a8ef6fe03d6ca0670268591
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YDdwv04AtJSSF1fmJC.hUD7sqt6JXMGcU4aFN
SmjXUZgfK6fmgyTSfT.Aae8HqfJJFmwyTQstY
xuPAOKspkHZVu4nHdk.FWNSw66Ndrhg68v0LI
6Zdfv0wAjt2qFuVfWc.QjrbloNYMffAiyVaS3
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Gqrjfqf.exe
Full Name
Gqrjfqf.exe
EntryPoint
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Scope Name
Gqrjfqf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gqrjfqf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: nop
ret <null>
nop <null>
ldsfld xL0wqAPsHGTP2Gj8BZr xL0wqAPsHGTP2Gj8BZr::pkLP6r5Bq6
call System.Byte[] xL0wqAPsHGTP2Gj8BZr::BYtPjWTxVZ(xL0wqAPsHGTP2Gj8BZr)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_e930f94ff8dd4a0199017de0bc837e89
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0122)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0122: leave IL_0038
ldc.i4 -490775056
neg <null>
ldc.i4 713227507
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_3f378f7d407b4d078d09045385c32996
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
ldc.i4 -2107181193
ldc.i4 -536033297
xor <null>
ldc.i4 1912091582
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_928f03e3899e40658d93ff907445c157
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
newobj System.Void oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld rseHZDPL2YGHHXmsZks rseHZDPL2YGHHXmsZks::ROgPrUnL3R
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c rseHZDPL2YGHHXmsZks::BYtPjWTxVZ(System.Object,System.Byte[],rseHZDPL2YGHHXmsZks)
ldsfld gem6Y0P0cPtsf7NUgyD gem6Y0P0cPtsf7NUgyD::hU4PhZayqv
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c gem6Y0P0cPtsf7NUgyD::BYtPjWTxVZ(System.Object,gem6Y0P0cPtsf7NUgyD)
ldsfld Ic4rH7P8QSbNMJZox6I Ic4rH7P8QSbNMJZox6I::HFxPDpch0R
call System.Void Ic4rH7P8QSbNMJZox6I::BYtPjWTxVZ(System.Object,Ic4rH7P8QSbNMJZox6I)
ldc.i4 3
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_60083b5a3fcc46e7bca1d0f3eded0a7a
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0122)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_c08322460da9444589b9f443b26b669b
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 0
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0155: ldloc V_0
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b911890bbb3d41b2afc7e90a63390f67
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld ouJuMmP4ianlp8JktNN ouJuMmP4ianlp8JktNN::HdvPt2egpm
call System.Void ouJuMmP4ianlp8JktNN::BYtPjWTxVZ(ouJuMmP4ianlp8JktNN)
ldc.i4 1
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b94f4dab1b834f4e8a6f88826632db29
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
Module Name
Gqrjfqf.exe
Full Name
Gqrjfqf.exe
EntryPoint
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Scope Name
Gqrjfqf.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Gqrjfqf
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void vtcMni1GrCDYUHjvfM.DeODVfPowRZoEJ3GdE::IROLPSMQI()
Main IL Instruction Count
100
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 990
beq IL_0010: ldloc V_3
br IL_0039: nop
ret <null>
nop <null>
ldsfld xL0wqAPsHGTP2Gj8BZr xL0wqAPsHGTP2Gj8BZr::pkLP6r5Bq6
call System.Byte[] xL0wqAPsHGTP2Gj8BZr::BYtPjWTxVZ(xL0wqAPsHGTP2Gj8BZr)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_e930f94ff8dd4a0199017de0bc837e89
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 0
br IL_0077: switch(IL_0097,IL_0122)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0122: leave IL_0038
ldc.i4 -490775056
neg <null>
ldc.i4 713227507
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_3f378f7d407b4d078d09045385c32996
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
ldc.i4 -2107181193
ldc.i4 -536033297
xor <null>
ldc.i4 1912091582
xor <null>
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_928f03e3899e40658d93ff907445c157
xor <null>
ldsfld ohUHZmPPArkhvXfxgyl ohUHZmPPArkhvXfxgyl::KbiP1jtGaa
call System.String ohUHZmPPArkhvXfxgyl::BYtPjWTxVZ(System.Int32,ohUHZmPPArkhvXfxgyl)
newobj System.Void oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c::.ctor(System.String,System.String)
ldloc.s V_1
ldsfld rseHZDPL2YGHHXmsZks rseHZDPL2YGHHXmsZks::ROgPrUnL3R
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c rseHZDPL2YGHHXmsZks::BYtPjWTxVZ(System.Object,System.Byte[],rseHZDPL2YGHHXmsZks)
ldsfld gem6Y0P0cPtsf7NUgyD gem6Y0P0cPtsf7NUgyD::hU4PhZayqv
call oCNtSFwTrpxmxVFYmxR.inFIOxwjgvMidE5V40c gem6Y0P0cPtsf7NUgyD::BYtPjWTxVZ(System.Object,gem6Y0P0cPtsf7NUgyD)
ldsfld Ic4rH7P8QSbNMJZox6I Ic4rH7P8QSbNMJZox6I::HFxPDpch0R
call System.Void Ic4rH7P8QSbNMJZox6I::BYtPjWTxVZ(System.Object,Ic4rH7P8QSbNMJZox6I)
ldc.i4 3
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_60083b5a3fcc46e7bca1d0f3eded0a7a
brtrue IL_0077: switch(IL_0097,IL_0122)
pop <null>
ldc.i4 1
br IL_0077: switch(IL_0097,IL_0122)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_c08322460da9444589b9f443b26b669b
brtrue IL_0159: switch(IL_0175)
pop <null>
ldc.i4 0
br IL_0159: switch(IL_0175)
br IL_0155: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0155: ldloc V_0
br IL_0175: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b911890bbb3d41b2afc7e90a63390f67
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
ldsfld ouJuMmP4ianlp8JktNN ouJuMmP4ianlp8JktNN::HdvPt2egpm
call System.Void ouJuMmP4ianlp8JktNN::BYtPjWTxVZ(ouJuMmP4ianlp8JktNN)
ldc.i4 1
ldsfld <Module>{09516355-40c4-4215-bd70-11c696f93020} <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_01ab90517af0456294a58daf0c349251
ldfld System.Int32 <Module>{09516355-40c4-4215-bd70-11c696f93020}::m_b94f4dab1b834f4e8a6f88826632db29
brfalse IL_0014: switch(IL_0039,IL_0199,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0039,IL_0199,IL_0038)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙