Malicious
Malicious

e429ab65933db993714bd558c51ed739

PE Executable
MD5: e429ab65933db993714bd558c51ed739
Size: 437.76 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 e429ab65933db993714bd558c51ed739
Sha1 8e8347acb1dd72e4da5ba8f10247d144c716ccb3
Sha256 5c25da03be38a0f41e28a6695b2f40a4df23e14c49798169449c9d3be0a01e70
Sha384 70f64731c484ffeda9a110010beae0c42af8b4a0beaf328a089c06564b910243179c00bd4490b6f92597ee5127b46543
Sha512 91ace53355ea939cfab861b9d3466aeed477c21a7994274787d6beee69161b7b4178e275c0d8b6162e49db4988af88300285316399fcf69c56272f64088186be
SSDeep 6144:3PWmzKfwWOSw9mz8PGyKi/kcVn/z4YDun+EjML4S0PC:3+mzKYWc2JQk+UYDu+EQ8S1
TLSH 8E943A2B36654E91C5890B73C1DB990083A6AA87F9E3F30FB28403A51D473FED947697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
e429ab65933db993714bd558c51ed739
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
24ymkGgoUqwueG0aIK.Bx6aDU3CSG0tkSfa9g
0JKyPvuANq7l2JNccJ.BJB8TDBV3GiUfmdD0j
gFsV1pHjjNChI5J6e4.Guu6eKGpkn4F1fnF3c
VnoK14I4nN2gJKPUJM.aGBcYssdthAyDLMb8n
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Wzyyl.exe
Full Name
Wzyyl.exe
EntryPoint
System.Void hAd6ZP0Qs5xrjlvUEB.OJYcHHPxL6MY12OQJ9::TW5NuTEOM()
Scope Name
Wzyyl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wzyyl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hAd6ZP0Qs5xrjlvUEB.OJYcHHPxL6MY12OQJ9::TW5NuTEOM()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ret
ret <null>
nop <null>
ldsfld cArM7XPtbSkkaen2QVe cArM7XPtbSkkaen2QVe::qqlPi7GMEI
call System.Byte[] cArM7XPtbSkkaen2QVe::AAtPrOGvBQ(cArM7XPtbSkkaen2QVe)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_10f77a48c2d34d62b9d5cff8e30b3f82
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1384368827
ldc.i4 -1384368827
ldc.i4 -1468219856
xor <null>
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_b8550605a8bd459ead84a9f8ff58c838
xor <null>
ldsfld QvT50xPevAcQFF9sNdx QvT50xPevAcQFF9sNdx::Y6OPE70TkR
call System.String QvT50xPevAcQFF9sNdx::AAtPrOGvBQ(System.Int32,QvT50xPevAcQFF9sNdx)
ldc.i4 1506297214
ldc.i4 1714135537
xor <null>
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_804523bd0566499c9ead18987e06c6e4
xor <null>
ldsfld QvT50xPevAcQFF9sNdx QvT50xPevAcQFF9sNdx::Y6OPE70TkR
call System.String QvT50xPevAcQFF9sNdx::AAtPrOGvBQ(System.Int32,QvT50xPevAcQFF9sNdx)
newobj System.Void B3KgDlmOTngcU5s567.MpUgQHyddSECPFnXcR::.ctor(System.String,System.String)
newobj System.Void MJaWtnsuPVQTmXFdojE.ikNDMDsGNCb1Yn47lTs::.ctor(B3KgDlmOTngcU5s567.MpUgQHyddSECPFnXcR)
ldloc.s V_3
ldsfld OKweZKPCYtfSfgupN0F OKweZKPCYtfSfgupN0F::JqtPz0dqkv
call System.Void OKweZKPCYtfSfgupN0F::AAtPrOGvBQ(System.Object,System.Byte[],OKweZKPCYtfSfgupN0F)
ldc.i4 0
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_b31a30969c6d4611a3971dcc7257d379
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_67eb8127479548649573e6351cc308dc
brfalse IL_0143: switch(IL_015F)
pop <null>
ldc.i4 0
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_8c887b52f7ad4e26b99a49b7ef6604f9
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld rqQ2EEP9Ai8ap3byVZc rqQ2EEP9Ai8ap3byVZc::BRJPJky7e2
call System.Void rqQ2EEP9Ai8ap3byVZc::AAtPrOGvBQ(rqQ2EEP9Ai8ap3byVZc)
ldc.i4 7
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_24ec83d142054b90b8479ff4ef321a1c
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
Module Name
Wzyyl.exe
Full Name
Wzyyl.exe
EntryPoint
System.Void hAd6ZP0Qs5xrjlvUEB.OJYcHHPxL6MY12OQJ9::TW5NuTEOM()
Scope Name
Wzyyl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wzyyl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void hAd6ZP0Qs5xrjlvUEB.OJYcHHPxL6MY12OQJ9::TW5NuTEOM()
Main IL Instruction Count
94
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0038: ret
ret <null>
nop <null>
ldsfld cArM7XPtbSkkaen2QVe cArM7XPtbSkkaen2QVe::qqlPi7GMEI
call System.Byte[] cArM7XPtbSkkaen2QVe::AAtPrOGvBQ(cArM7XPtbSkkaen2QVe)
stloc.s V_3
ldc.i4 1
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_10f77a48c2d34d62b9d5cff8e30b3f82
brtrue IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 5
br IL_0077: switch(IL_010C,IL_0097)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0097: ldc.i4 -1384368827
ldc.i4 -1384368827
ldc.i4 -1468219856
xor <null>
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_b8550605a8bd459ead84a9f8ff58c838
xor <null>
ldsfld QvT50xPevAcQFF9sNdx QvT50xPevAcQFF9sNdx::Y6OPE70TkR
call System.String QvT50xPevAcQFF9sNdx::AAtPrOGvBQ(System.Int32,QvT50xPevAcQFF9sNdx)
ldc.i4 1506297214
ldc.i4 1714135537
xor <null>
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_804523bd0566499c9ead18987e06c6e4
xor <null>
ldsfld QvT50xPevAcQFF9sNdx QvT50xPevAcQFF9sNdx::Y6OPE70TkR
call System.String QvT50xPevAcQFF9sNdx::AAtPrOGvBQ(System.Int32,QvT50xPevAcQFF9sNdx)
newobj System.Void B3KgDlmOTngcU5s567.MpUgQHyddSECPFnXcR::.ctor(System.String,System.String)
newobj System.Void MJaWtnsuPVQTmXFdojE.ikNDMDsGNCb1Yn47lTs::.ctor(B3KgDlmOTngcU5s567.MpUgQHyddSECPFnXcR)
ldloc.s V_3
ldsfld OKweZKPCYtfSfgupN0F OKweZKPCYtfSfgupN0F::JqtPz0dqkv
call System.Void OKweZKPCYtfSfgupN0F::AAtPrOGvBQ(System.Object,System.Byte[],OKweZKPCYtfSfgupN0F)
ldc.i4 0
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_b31a30969c6d4611a3971dcc7257d379
brfalse IL_0077: switch(IL_010C,IL_0097)
pop <null>
ldc.i4 4
br IL_0077: switch(IL_010C,IL_0097)
leave IL_0038: ret
pop <null>
ldc.i4 6
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_67eb8127479548649573e6351cc308dc
brfalse IL_0143: switch(IL_015F)
pop <null>
ldc.i4 0
br IL_0143: switch(IL_015F)
br IL_013F: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_013F: ldloc V_1
br IL_015F: leave IL_0038
leave IL_0038: ret
ldc.i4 7
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_8c887b52f7ad4e26b99a49b7ef6604f9
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
ldsfld rqQ2EEP9Ai8ap3byVZc rqQ2EEP9Ai8ap3byVZc::BRJPJky7e2
call System.Void rqQ2EEP9Ai8ap3byVZc::AAtPrOGvBQ(rqQ2EEP9Ai8ap3byVZc)
ldc.i4 7
ldsfld <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7} <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_d8ab02096f984735962896c14af61f8a
ldfld System.Int32 <Module>{e4ecd9a5-eb8e-4000-b4af-9f59ca664bb7}::m_24ec83d142054b90b8479ff4ef321a1c
brtrue IL_0014: switch(IL_0038,IL_0039,IL_0183)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_0183)
e429ab65933db993714bd558c51ed739
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
24ymkGgoUqwueG0aIK.Bx6aDU3CSG0tkSfa9g
0JKyPvuANq7l2JNccJ.BJB8TDBV3GiUfmdD0j
gFsV1pHjjNChI5J6e4.Guu6eKGpkn4F1fnF3c
VnoK14I4nN2gJKPUJM.aGBcYssdthAyDLMb8n
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙