Suspicious
Suspect

ed2972345edb2d887052dccaff556aa8

Share on LinkedIn
Print
PE Executable
MD5: ed2972345edb2d887052dccaff556aa8
Size: 859.14 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 ed2972345edb2d887052dccaff556aa8
Sha1 1bd1099ae886df044bd5c1f1a1a5f17344708070
Sha256 750343b29466f6258ae1d26c00fcbd3e98f2000d80eb9d2ad9496e9fda5c422f
Sha384 af244e473f5556d84e71efcadcad6a0c49fab9b572a064e8e58b13bc1841135dc4c12732e2c539805bd3f75732c081a6
Sha512 e4c8eb580618f17f32de288bcb3e1639699e14ad2b244ca383e38034610896a88947f01831080f84115706569d67ba96dc96e06a7b6cbb4085846b0ccd6999d1
SSDeep 24576:dNEuwgjcUQ1vF35GPfUJ/sECkZEMd6itIK:dNEuLjSvh5GPfUJyPMF
TLSH 3F05F1350D436F84CB3D5BB8C0262D9963F1D41B9222EB6A3FED01F91AB7BC46E26151
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
ed2972345edb2d887052dccaff556aa8
.Net Resources
3gcWL9zzeo1T.Resources.resources
3gcWL9zzeo1T.g.resources
8f161ccbbc290a.Resources.resources
b26aa0bc0
[NBF]root.Data
b26aa0bc1
[NBF]root.Data
b26aa0bc2
[NBF]root.Data
b26aa0bc3
[NBF]root.Data
b26aa0bc4
[NBF]root.Data
b26aa0bc5
[NBF]root.Data
b26aa0bc6
[NBF]root.Data
b26aa0bc7
[NBF]root.Data
b26aa0bc8
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
3gcWL9zzeo1T
Full Name
3gcWL9zzeo1T
EntryPoint
System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
Scope Name
3gcWL9zzeo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3gcWL9zzeo1T
Assembly Version
25.23.8.21
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
Main IL Instruction Count
177
Main IL 
ldsfld System.Char[] Yek6z7NqTmm9.tc1X8::1qqTtdK
stloc.s V_12
nop <null>
br.s IL_000A: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0056: nop
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
nop <null>
ldc.i4.8 <null>
ldc.i4 1311946314
ldc.i4.2 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0/8DzaXfm3.4QeyEn::st6E4YzgpeH(System.Int32,System.Int32,System.Int32)
call System.Boolean Fa5j7gsY_nM48.ay3T2Pa/9Riey7oYbkZ1.8Ffft6g::0Nyam5eFgR3a4s(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldc.i4.s 13
stloc.s V_11
br.s IL_000D: ldloc.s V_11
ldloc.s V_7
brfalse.s IL_0084: ldc.i4.3
ldc.i4.s 15
stloc.s V_11
br.s IL_000D: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_0080: stloc.s V_11
leave IL_0203: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldloc.s V_12
ldc.i4 310
ldelem.u2 <null>
ldc.i4 16577
sub <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1742642344
ldc.i4.s 23
ldc.i4.0 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 1103800497
ldc.i4.s 14
call System.String Aep1tf2C.Kig4fo::Gc2d4xyXW8(System.Int32,System.Int32,System.Byte)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldnull <null>
ldc.i4 1742642346
ldc.i4.s 23
ldc.i4.6 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] 4gnKi.1aoJzxQ7::pRm1S0ogcT(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldc.i4.6 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldloc.s V_8
brfalse.s IL_0140: ldc.i4.7
ldc.i4.4 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldc.i4.7 <null>
br.s IL_0139: stloc.s V_11
leave IL_0203: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] 8mmYn2.9AdgCs3j7P/1nxFD6kc4tYeA.Nrp07mRen8e::Btn97aSfj(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldc.i4.6 <null>
ldc.i4 1103800493
ldc.i4.s 10
call System.String Aep1tf2C.Kig4fo::Gc2d4xyXW8(System.Int32,System.Int32,System.Byte)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object bj5ST8icrL.9Nnjtw6BX8mjq::oo3MD7kq(System.String,System.Object)
pop <null>
ldc.i4.s 11
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1742642331
ldc.i4.3 <null>
ldc.i4.5 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
nop <null>
ldc.i4.1 <null>
ldc.i4 1311946301
ldc.i4.3 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0/8DzaXfm3.4QeyEn::st6E4YzgpeH(System.Int32,System.Int32,System.Int32)
call System.Void 3KxsYpd5.0znCdzK::ny5KiDw4x1(System.String,System.String)
ldc.i4.s 10
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
leave.s IL_01D7: br.s IL_01D9
br.s IL_01BE: br.s IL_01C0
br.s IL_01C0: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01D7: br.s IL_01D9
br.s IL_01D9: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01FD: nop
nop <null>
ldc.i4.3 <null>
stloc.s V_14
br.s IL_01DC: ldloc.s V_14
ret <null>
ldtoken System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
pop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
3gcWL9zzeo1T
Full Name
3gcWL9zzeo1T
EntryPoint
System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
Scope Name
3gcWL9zzeo1T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3gcWL9zzeo1T
Assembly Version
25.23.8.21
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
Main IL Instruction Count
177
Main IL 
ldsfld System.Char[] Yek6z7NqTmm9.tc1X8::1qqTtdK
stloc.s V_12
nop <null>
br.s IL_000A: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0056: nop
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
nop <null>
ldc.i4.8 <null>
ldc.i4 1311946314
ldc.i4.2 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0/8DzaXfm3.4QeyEn::st6E4YzgpeH(System.Int32,System.Int32,System.Int32)
call System.Boolean Fa5j7gsY_nM48.ay3T2Pa/9Riey7oYbkZ1.8Ffft6g::0Nyam5eFgR3a4s(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldc.i4.s 13
stloc.s V_11
br.s IL_000D: ldloc.s V_11
ldloc.s V_7
brfalse.s IL_0084: ldc.i4.3
ldc.i4.s 15
stloc.s V_11
br.s IL_000D: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_0080: stloc.s V_11
leave IL_0203: ret
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.1 <null>
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldloc.1 <null>
call System.Array System.Array::CreateInstance(System.Type,System.Int32)
castclass System.Object[]
stloc.2 <null>
ldloc.s V_12
ldc.i4 310
ldelem.u2 <null>
ldc.i4 16577
sub <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1742642344
ldc.i4.s 23
ldc.i4.0 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
ldc.i4.2 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 1103800497
ldc.i4.s 14
call System.String Aep1tf2C.Kig4fo::Gc2d4xyXW8(System.Int32,System.Int32,System.Byte)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldnull <null>
ldc.i4 1742642346
ldc.i4.s 23
ldc.i4.6 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
stelem.ref <null>
call System.String System.String::Join(System.String,System.String[])
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.3 <null>
stelem.ref <null>
newobj System.Void System.Windows.Forms.Panel::.ctor()
stloc.s V_4
ldloc.3 <null>
call System.Byte[] 4gnKi.1aoJzxQ7::pRm1S0ogcT(System.String)
stloc.s V_5
ldloc.s V_5
ldnull <null>
ceq <null>
stloc.s V_8
ldc.i4.6 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldloc.s V_8
brfalse.s IL_0140: ldc.i4.7
ldc.i4.4 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
ldc.i4.7 <null>
br.s IL_0139: stloc.s V_11
leave IL_0203: ret
ldloc.s V_5
call System.Void System.Array::Reverse(System.Array)
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_5
call System.Byte[] 8mmYn2.9AdgCs3j7P/1nxFD6kc4tYeA.Nrp07mRen8e::Btn97aSfj(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldc.i4.6 <null>
ldc.i4 1103800493
ldc.i4.s 10
call System.String Aep1tf2C.Kig4fo::Gc2d4xyXW8(System.Int32,System.Int32,System.Byte)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object bj5ST8icrL.9Nnjtw6BX8mjq::oo3MD7kq(System.String,System.Object)
pop <null>
ldc.i4.s 11
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
ldnull <null>
ldc.i4 1742642331
ldc.i4.3 <null>
ldc.i4.5 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0::po5L9B(System.String,System.Int32,System.Byte,System.Int32)
nop <null>
ldc.i4.1 <null>
ldc.i4 1311946301
ldc.i4.3 <null>
call System.String Aep1tf2C.Kig4fo/Pds9ba0MQ7ryf.Zz1pf0/8DzaXfm3.4QeyEn::st6E4YzgpeH(System.Int32,System.Int32,System.Int32)
call System.Void 3KxsYpd5.0znCdzK::ny5KiDw4x1(System.String,System.String)
ldc.i4.s 10
stloc.s V_11
br IL_000D: ldloc.s V_11
nop <null>
leave.s IL_01D7: br.s IL_01D9
br.s IL_01BE: br.s IL_01C0
br.s IL_01C0: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01D7: br.s IL_01D9
br.s IL_01D9: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01FD: nop
nop <null>
ldc.i4.3 <null>
stloc.s V_14
br.s IL_01DC: ldloc.s V_14
ret <null>
ldtoken System.Void Fa5j7gsY_nM48.ay3T2Pa/kj5Ts0FcGe2.Re8_3Q::9Zgf_t4NBqj7of()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙