dee3308c48a52fc15394c3e89221226d

PE Executable

MD5: dee3308c48a52fc15394c3e89221226d

Size: 24.06 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Low

MD5	dee3308c48a52fc15394c3e89221226d
Sha1	b5a9f5007839560266d831d25d1db4429d07c9fc
Sha256	3e08292340a925412039c40af6eefec9a30fca1e60246baca93caf9f4bd3e53c
Sha384	d617831ef57fa1aa41c1e03e7bc871169f4a1af820642aac41e17f4ba100267b791839469c120ac20a576bd5f6843e0a
Sha512	e064f5694af65b7e34f13658d59cfcb901eb81b4f74834cc85a7fecc9c079f9506b485cb8df309609cd172e29ed78779b5c8fa646883ba0bdf43a5510bc604ad
SSDeep	384:78aSyS9gB3Y1KIay2X8cLZI6XgxsGJVPpmRvR6JZlbw8hqIusZzZ5O:w589tXvRpcnuX
TLSH	4BB22A4E3FA98856C5BC17748AA5965003B591470413EE3FCCC960CBAFB3ADA1D4CAF9

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
victim_name [VN]	Hahuhuhuhu
version [VR]	0huhuhuhu
executable_name [EXE]	serhuhuhuhu
directory [DR]	Thuhuhuhu
reg_key [RG]	652fabhuhuhuhuhuhuhuhuhuhuhu
cnc_host [H]	subhanhuhuhuhuhuhuhu
cnc_port [P]	1huhuhuhu
splitter [Y]	\|huhuhuhu
BD [BD]	Thuhuhuhu
is_dir_defined [Idr]	Thuhuhuhu
is_startup_folder [IsF]	Fhuhuhuhu
is_user_reg [Isu]	Thuhuhuhu
reg_path [sf]	Softwahuhuhuhuhuhuhuhuhuhuhu
packet_size [b]	5huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	j.exe
Full Name	j.exe
EntryPoint	System.Void j.A::main()
Scope Name	j.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	j
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	214
Main Method	System.Void j.A::main()
Main IL Instruction Count	2
Main IL	`call System.Void j.OK::ko() ret <null>`
Module Name	j.exe
Full Name	j.exe
EntryPoint	System.Void j.A::main()
Scope Name	j.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v2.0.50727
Tables Header Version	512
WinMD Version	<null>
Assembly Name	j
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	214
Main Method	System.Void j.A::main()
Main IL Instruction Count	2
Main IL	`call System.Void j.OK::ko() ret <null>`

CnC CNCmalicious

subhanhuhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
victim_name [VN]	Hahuhuhuhu
version [VR]	0huhuhuhu
executable_name [EXE]	serhuhuhuhu
directory [DR]	Thuhuhuhu
reg_key [RG]	652fabhuhuhuhuhuhuhuhuhuhuhu
cnc_host [H]	subhanhuhuhuhuhuhuhu
cnc_port [P]	1huhuhuhu
splitter [Y]	\|huhuhuhu
BD [BD]	Thuhuhuhu
is_dir_defined [Idr]	Thuhuhuhu
is_startup_folder [IsF]	Fhuhuhuhu
is_user_reg [Isu]	Thuhuhuhu
reg_path [sf]	Softwahuhuhuhuhuhuhuhuhuhuhu
packet_size [b]	5huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

CnC CNCmalicious

subhanhuhuhuhuhuhuhu

dee3308c48a52fc15394c3e89221226d

Port PORTmalicious

1huhuhuhu

dee3308c48a52fc15394c3e89221226d

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.