Malicious
Malicious

f48adedd79b57519affc9ee5ec8c3958

PE Executable
MD5: f48adedd79b57519affc9ee5ec8c3958
Size: 829.95 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f48adedd79b57519affc9ee5ec8c3958
Sha1 42ed4d3bfcf886995f2fb320d7ff1238d7dfe47d
Sha256 a19d356251a87c785bcef042bbfe0e0bff1a908fb2a5bf095c4df04d6a5bc0df
Sha384 0773d0e808cda372a319ba0c9becff5d4629dced157f76e91248ce33eee65a484a89fee9000efd6d89e583ef25b019c4
Sha512 b92ee68d4627e10c4a38e5d6ecbb30eb0437b7f988ce0bf806b2cc52fe3a443234b1b7d720823ab1d6f81ca2b8b33f5a5829940c930ffb9d4cf116772a57c349
SSDeep 12288:2Pcks/TE91Qo93JHwvNl28CvBOmbPxam2xC1aFq1hKGtyb8NrGst3:2rQo9pguxBjxam2YCEKGEb8Rz3
TLSH 0D05AF3A36A28F21C24A4373C5C7490097E69A8736A7EB0B71C513D61D037FEDE4A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
f48adedd79b57519affc9ee5ec8c3958
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
iQsrXHnZYusXQOrTRo.7KYPvc3rZWboSxGRBm
pqpAs8LJJCEUPBstMa.IoIcFWchL0WauMPfvM
ITpjfG0wDguMmolgrI.bXZ0cDYDY4BTniafyF
9VZ5bfim9XH6Fifx4Y.xuIADqrxTrpBPYUuMP
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ypkmeb.exe
Full Name
Ypkmeb.exe
EntryPoint
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Scope Name
Ypkmeb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ypkmeb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld TfxmBcbL3hCSgitew3p TfxmBcbL3hCSgitew3p::kHebc7TE6N
call System.Void TfxmBcbL3hCSgitew3p::p6rbkwMLC1(TfxmBcbL3hCSgitew3p)
ldc.i4 6
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c676f9defecf495f94df506b646682b5
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld j2BIFob0IEKpKXJQLej j2BIFob0IEKpKXJQLej::MRdbYm0hDU
call System.Byte[] j2BIFob0IEKpKXJQLej::p6rbkwMLC1(j2BIFob0IEKpKXJQLej)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_26a19161f54c4ac7b49a8dd24383258f
brtrue IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 1623756647
ldc.i4 1623756647
ldc.i4 1433243321
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_ecbdbba7419344f896c5c9fc03817719
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
ldc.i4 -1782268854
ldc.i4 -1984033265
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_8b30d55de2004820b67b12041eb7f4ba
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
newobj System.Void YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld k5kShDbvXd1lNSbeiUY k5kShDbvXd1lNSbeiUY::hogbFGNAe8
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G k5kShDbvXd1lNSbeiUY::p6rbkwMLC1(System.Object,System.Byte[],k5kShDbvXd1lNSbeiUY)
ldsfld CKYkt0besfT9r9SXTUP CKYkt0besfT9r9SXTUP::IKsbaHd6Fw
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G CKYkt0besfT9r9SXTUP::p6rbkwMLC1(System.Object,CKYkt0besfT9r9SXTUP)
ldsfld YoWMnRbJ2l9ylTlANHh YoWMnRbJ2l9ylTlANHh::fFRbt4GyAA
call System.Void YoWMnRbJ2l9ylTlANHh::p6rbkwMLC1(System.Object,YoWMnRbJ2l9ylTlANHh)
ldc.i4 4
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_13ca1ebd3ff742df98863774c4dc7e63
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_dd6fa95c404f4504a706ac3d9dcd6f8b
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_0061
leave IL_0061: ret
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c3481bd0fc844a9d8e7a10d11c0b0931
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Ypkmeb.exe
Full Name
Ypkmeb.exe
EntryPoint
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Scope Name
Ypkmeb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ypkmeb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld TfxmBcbL3hCSgitew3p TfxmBcbL3hCSgitew3p::kHebc7TE6N
call System.Void TfxmBcbL3hCSgitew3p::p6rbkwMLC1(TfxmBcbL3hCSgitew3p)
ldc.i4 6
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c676f9defecf495f94df506b646682b5
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld j2BIFob0IEKpKXJQLej j2BIFob0IEKpKXJQLej::MRdbYm0hDU
call System.Byte[] j2BIFob0IEKpKXJQLej::p6rbkwMLC1(j2BIFob0IEKpKXJQLej)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_26a19161f54c4ac7b49a8dd24383258f
brtrue IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 1623756647
ldc.i4 1623756647
ldc.i4 1433243321
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_ecbdbba7419344f896c5c9fc03817719
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
ldc.i4 -1782268854
ldc.i4 -1984033265
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_8b30d55de2004820b67b12041eb7f4ba
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
newobj System.Void YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld k5kShDbvXd1lNSbeiUY k5kShDbvXd1lNSbeiUY::hogbFGNAe8
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G k5kShDbvXd1lNSbeiUY::p6rbkwMLC1(System.Object,System.Byte[],k5kShDbvXd1lNSbeiUY)
ldsfld CKYkt0besfT9r9SXTUP CKYkt0besfT9r9SXTUP::IKsbaHd6Fw
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G CKYkt0besfT9r9SXTUP::p6rbkwMLC1(System.Object,CKYkt0besfT9r9SXTUP)
ldsfld YoWMnRbJ2l9ylTlANHh YoWMnRbJ2l9ylTlANHh::fFRbt4GyAA
call System.Void YoWMnRbJ2l9ylTlANHh::p6rbkwMLC1(System.Object,YoWMnRbJ2l9ylTlANHh)
ldc.i4 4
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_13ca1ebd3ff742df98863774c4dc7e63
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_dd6fa95c404f4504a706ac3d9dcd6f8b
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_0061
leave IL_0061: ret
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c3481bd0fc844a9d8e7a10d11c0b0931
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
f48adedd79b57519affc9ee5ec8c3958
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
iQsrXHnZYusXQOrTRo.7KYPvc3rZWboSxGRBm
pqpAs8LJJCEUPBstMa.IoIcFWchL0WauMPfvM
ITpjfG0wDguMmolgrI.bXZ0cDYDY4BTniafyF
9VZ5bfim9XH6Fifx4Y.xuIADqrxTrpBPYUuMP
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙