e7588cf607ced3a11f721596417725aa

PE Executable

MD5: e7588cf607ced3a11f721596417725aa

Size: 1.4 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Medium

MD5	e7588cf607ced3a11f721596417725aa
Sha1	b95c12de7da353892e5646c2fe09fe445a58208a
Sha256	bcfaa0d39610dc86343bc3efb5e40c7f9fdea725c99bcb308dff9785c77e7774
Sha384	28cf015a1b0a7521695f16f6ed08c4aa354c5203a69109136becc9464eecadee2f4d2cde30fd6cb6ebf9b7dfff1f7500
Sha512	8d45ffd1fee1194f42630ef7dd47b4a92de13171e8c1686789fe09d0cc41aafa5914c9ac06430b92f28806eabd5625275d3f9344ab886998ecbe85208034dc3a
SSDeep	24576:0L8gQ3y1Kmo9uH7SPzf7tfmr54/oHETC8qhrdROgCW2MTs:0Ag+yUDhfE5cKE2rhROwO
TLSH	F555F014A116CC12C4E956B2C4D1D1FF12B56E4BE452F2876AC93DAF3A327A1FB906C3

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Name	Value
Module Name	rBrE.exe
Full Name	rBrE.exe
EntryPoint	System.Void xv.EJ::gH()
Scope Name	rBrE.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	rBrE
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5
Info	PE Detect: PeReader OK (file layout)
Total Strings	432
Main Method	System.Void xv.EJ::gH()
Main IL Instruction Count	45
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: nop nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) br IL_0090: call System.Void JMb.CMA::nlq() newobj System.Void spu.ppt::.ctor() stsfld spu.ppt xv.EJ::sr br IL_003F: newobj System.Void Xc3.McR::.ctor() newobj System.Void Xc3.McR::.ctor() stsfld Xc3.McR xv.EJ::DU br IL_00A9: ldsfld Xc3.McR xv.EJ::DU nop <null> call System.Void xv.EJ::m2() br IL_0080: nop nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 0 ldsfld <Module>{9440d506-410e-44d7-a2e5-92212e5317e1} <Module>{9440d506-410e-44d7-a2e5-92212e5317e1}::m_8a1cb10fbe6842439bccb65b361b5138 ldfld System.Int32 <Module>{9440d506-410e-44d7-a2e5-92212e5317e1}::m_ae0762685a76417ba281ad6fd0d583d2 brtrue IL_0012: switch(IL_0024,IL_0059) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0059) nop <null> ret <null> nop <null> newobj System.Void WF4.bFy::.ctor() stsfld WF4.bFy xv.EJ::Lf br IL_009A: newobj System.Void pCg.cCE::.ctor() call System.Void JMb.CMA::nlq() br IL_004E: nop newobj System.Void pCg.cCE::.ctor() stsfld pCg.cCE xv.EJ::KY br IL_00B8: newobj System.Void tCx.zC2::.ctor() ldsfld Xc3.McR xv.EJ::DU call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) br IL_007E: nop newobj System.Void tCx.zC2::.ctor() stsfld tCx.zC2 xv.EJ::bZ br IL_0030: newobj System.Void spu.ppt::.ctor()

No malware configuration was found at this point.

You must be signed in to view YARA rules.