Malicious
Malicious

08efdc76f3809e93f6d0fa8bcea60aa4849a3c[...]ned.exe

Share on LinkedIn
Print
PE Executable
MD5: e5880f4f99ce950423ad6d0e151940c5
Size: 1.34 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 e5880f4f99ce950423ad6d0e151940c5
Sha1 167606da2d5b9242f610dca3a19c46a6f8ce5caf
Sha256 b3ad484385a97d8b4831cc689c03de9d74a2dfaa6b9d3cd11863cd53abe0e9a5
Sha384 96524dad78237f1c81249989f835fd93059c6354734ca92c21e11baafe8381a07ef3dfa30760faf413883c912d47f40f
Sha512 4baf5079416aca0a676c0cad54a2421d8fa7b5028c8115d8539f26aef0569609443d5b05323f84787f36337c12c8abc403a64130a07c7a4b9a6c1f86ac466c34
SSDeep 24576:e+C2ikqKvNHro47TtsW6OUu8dXAIO9yu:e+PbBve47Td8dXtu
TLSH 9B55AF6037A69149D97B0B751C7592C013BA37677E88CB9E6848624DDC33B13CB12EEB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
08efdc76f3809e93f6d0fa8bcea60aa4849a3cb0d04f3b5c8293559cca82af74-cleaned.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Sg.ed.resources
panel1.Dock
panel1.Size
checkThink.Anchor
richTextMsg.Size
richTextMsg.Font
butEdit.Margin
butRegen.Image
[NBF]root.Data
[NBF]root.Data-preview.png
butDelete.Size
labelRole.Size
labelRole.Font
butRegen.Location
butEdit.Location
butEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
richTextMsg.ScrollBars
richTextMsg.Anchor
butDelete.Image
[NBF]root.Data
[NBF]root.Data-preview.png
checkThink.Location
butDelete.Location
checkThink.Size
labelRole.Location
richTextMsg.Location
$this.AutoScaleDimensions
butCancelEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
panel1.Location
butApplyEdit.Image
[NBF]root.Data
[NBF]root.Data-preview.png
fMc.UM2.resources
radioBasicVAD.Margin
toolStripStatusLabel1.Size
label10.Margin
tabPageHuggingFace.Location
numFreqThreshold.Location
listViewMeta.Size
checkCMDEnable.ImeMode
numCtxSize.Location
checkMLock.Location
checkLoadAuto.Anchor
textGoogleApiKey.Location
checkOverrideJinjaModel.TextAlign
textSearchTerm.Anchor
butSearch.Location
label12.Size
butVADDown.Location
radioBasicVAD.Size
groupCommon.Location
numMinP.Location
numVadThreshold.Location
checkOverrideSettings.Location
label13.Size
groupCommonModel.Size
checkStream.Size
label16.Size
textSystemPrompt.Location
numGenDelay.Location
numTemp.Location
label14.Size
label28.Location
$this.Icon
[NBF]root.IconData
checkMarkdown.Location
label17.Size
label19.Location
tabControl1.Size
checkFileListEnable.Size
label15.Size
label30.Margin
comboVADModel.Size
checkStream.Location
butApplyModelSettings.Location
labelEditing.Size
labelEditing.Font
label7.Location
label10.Location
checkFileCreateEnable.Location
panelChat.Size
label19.Size
numTopK.Location
label20.Size
checkDateTimeEnable.Location
groupAdvanced.Location
$this.ClientSize
label22.Size
butApply.Location
checkMarkdown.Size
numWhisperTemp.Location
textInput.Size
label22.Location
statusStrip1.Size
label3.Size
groupBox8.Size
listViewHugSearch.Size
textSearchTerm.Location
butGen.Location
label1.Size
textModelsPath.Location
numWhisperTemp.Size
comboVADModel.Location
groupBox6.Size
groupBox7.Size
groupAdvancedModel.Size
labelTPS.Size
groupBox4.Size
butSearch.Size
label29.Location
textInput.ScrollBars
numWakeWordSimilarity.Location
numApiServerPort.Location
groupBox2.Size
label8.Location
checkFlashAttnModel.Location
label12.Location
label20.Location
label23.Location
checkOverrideJinjaModel.Location
statusStrip1.Padding
label11.Location
checkVoiceInput.Location
groupBox1.Size
splitContainer2.Orientation
butBrowse.Location
numTopP.Location
labelPreGen.Size
numGoogleResults.Location
splitContainer1.Size
groupBox4.Location
checkFileReadEnable.Location
panelChat.FlowDirection
textModelsPath.Size
splitContainer3.Size
labelSystemPromptModel.Size
butWhispDown.Location
numTopPModel.Location
groupCPUParamsBatch.Size
label9.Location
textSearchTerm.Size
checkFlashAttn.Location
textJinjaTmplModel.Location
labelTokens.Size
butReset.Location
checkDialectic.Location
checkWhisperUseGPU.Location
listViewHugFiles.Size
checkAutoScroll.Size
groupBox6.Location
groupBox5.Location
checkFileWriteEnable.Size
splitContainer3.Location
textGoogleSearchID.Size
labelSystemPromptModel.Location
label13.Location
butVADDown.Size
label30.Size
label30.Location
label21.Location
progressBar1.Size
checkMMap.Location
linkFileInstruction.Location
FV7
groupAdvanced.Size
textGoogleApiKey.Size
label14.Location
checkAutoScroll.Location
statusStrip1.Location
textSystemPromptModel.Size
groupBox7.Location
butGen.Anchor
textFileBasePath.Size
textJinjaTmplModel.Size
label26.Location
butCodeBlock.Location
groupCommon.Size
checkVoiceInput.Size
comboNUMAStrat.Size
checkSpeak.Location
textSystemPrompt.Size
progressBar1.Anchor
linkFileInstruction.Size
checkFileWriteEnable.Location
label16.Location
label24.Location
numRepPen.Location
checkDialectic.Size
textWakeWord.Size
label15.Location
comboWhisperModel.Location
toolTip1.TrayLocation
groupCPUParamsBatch.Location
tabPageModelSettings.Size
label3.Location
tabPageSettings.Size
butCodeBlock.Size
openFileDialog1.TrayLocation
statusStrip1.TrayLocation
checkSpeak.Size
groupBox2.Location
groupBox1.Location
groupCPUParams.Location
listViewModels.Size
$this.StartPosition
checkLoadAuto.Location
numGoogleResults.Size
textSystemPromptModel.Location
textFileBasePath.Location
linkFileInstruction.Anchor
label17.Location
groupCommonModel.Location
butBrowseJinjaTmplModel.Location
numBatchSize.Location
label25.Location
groupAdvancedModel.Location
label4.Location
textWakeWord.Location
folderBrowserDialog1.TrayLocation
tabControlModelStuff.Size
groupBox8.Location
$this.AutoScaleDimensions
checkLoadAuto.Size
numNGen.Location
textGoogleSearchID.Location
label18.Location
groupJinjaTmplModel.Location
label6.Location
checkOverrideSettings.Size
checkApiServerEnable.Location
groupBox3.Location
Zezy.g.resources
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
LMStud.Properties.Resources.resources
OCho
[NBF]root.Data
[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>pe:rsrc>img
Shape pe:exe>pe:rsrc>img
malicious 3 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Zezy.exe
Full Name
Zezy.exe
EntryPoint
System.Void Umb.Qmh::omJ()
Scope Name
Zezy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zezy
Assembly Version
8.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
673
Main Method
System.Void Umb.Qmh::omJ()
Main IL Instruction Count
7
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void syy.cyW::oQN()
newobj System.Void fMc.UM2::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Zezy.exe
Full Name
Zezy.exe
EntryPoint
System.Void Umb.Qmh::omJ()
Scope Name
Zezy.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zezy
Assembly Version
8.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
673
Main Method
System.Void Umb.Qmh::omJ()
Main IL Instruction Count
7
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void syy.cyW::oQN()
newobj System.Void fMc.UM2::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙