Malicious
Malicious

f48adedd79b57519affc9ee5ec8c3958

Share on LinkedIn
Print
PE Executable
MD5: f48adedd79b57519affc9ee5ec8c3958
Size: 829.95 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f48adedd79b57519affc9ee5ec8c3958
Sha1 42ed4d3bfcf886995f2fb320d7ff1238d7dfe47d
Sha256 a19d356251a87c785bcef042bbfe0e0bff1a908fb2a5bf095c4df04d6a5bc0df
Sha384 0773d0e808cda372a319ba0c9becff5d4629dced157f76e91248ce33eee65a484a89fee9000efd6d89e583ef25b019c4
Sha512 b92ee68d4627e10c4a38e5d6ecbb30eb0437b7f988ce0bf806b2cc52fe3a443234b1b7d720823ab1d6f81ca2b8b33f5a5829940c930ffb9d4cf116772a57c349
SSDeep 12288:2Pcks/TE91Qo93JHwvNl28CvBOmbPxam2xC1aFq1hKGtyb8NrGst3:2rQo9pguxBjxam2YCEKGEb8Rz3
TLSH 0D05AF3A36A28F21C24A4373C5C7490097E69A8736A7EB0B71C513D61D037FEDE4A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
f48adedd79b57519affc9ee5ec8c3958
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
iQsrXHnZYusXQOrTRo.7KYPvc3rZWboSxGRBm
pqpAs8LJJCEUPBstMa.IoIcFWchL0WauMPfvM
ITpjfG0wDguMmolgrI.bXZ0cDYDY4BTniafyF
9VZ5bfim9XH6Fifx4Y.xuIADqrxTrpBPYUuMP
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ypkmeb.exe
Full Name
Ypkmeb.exe
EntryPoint
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Scope Name
Ypkmeb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ypkmeb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld TfxmBcbL3hCSgitew3p TfxmBcbL3hCSgitew3p::kHebc7TE6N
call System.Void TfxmBcbL3hCSgitew3p::p6rbkwMLC1(TfxmBcbL3hCSgitew3p)
ldc.i4 6
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c676f9defecf495f94df506b646682b5
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld j2BIFob0IEKpKXJQLej j2BIFob0IEKpKXJQLej::MRdbYm0hDU
call System.Byte[] j2BIFob0IEKpKXJQLej::p6rbkwMLC1(j2BIFob0IEKpKXJQLej)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_26a19161f54c4ac7b49a8dd24383258f
brtrue IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 1623756647
ldc.i4 1623756647
ldc.i4 1433243321
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_ecbdbba7419344f896c5c9fc03817719
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
ldc.i4 -1782268854
ldc.i4 -1984033265
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_8b30d55de2004820b67b12041eb7f4ba
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
newobj System.Void YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld k5kShDbvXd1lNSbeiUY k5kShDbvXd1lNSbeiUY::hogbFGNAe8
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G k5kShDbvXd1lNSbeiUY::p6rbkwMLC1(System.Object,System.Byte[],k5kShDbvXd1lNSbeiUY)
ldsfld CKYkt0besfT9r9SXTUP CKYkt0besfT9r9SXTUP::IKsbaHd6Fw
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G CKYkt0besfT9r9SXTUP::p6rbkwMLC1(System.Object,CKYkt0besfT9r9SXTUP)
ldsfld YoWMnRbJ2l9ylTlANHh YoWMnRbJ2l9ylTlANHh::fFRbt4GyAA
call System.Void YoWMnRbJ2l9ylTlANHh::p6rbkwMLC1(System.Object,YoWMnRbJ2l9ylTlANHh)
ldc.i4 4
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_13ca1ebd3ff742df98863774c4dc7e63
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_dd6fa95c404f4504a706ac3d9dcd6f8b
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_0061
leave IL_0061: ret
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c3481bd0fc844a9d8e7a10d11c0b0931
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
Module Name
Ypkmeb.exe
Full Name
Ypkmeb.exe
EntryPoint
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Scope Name
Ypkmeb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ypkmeb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void PbaY2K5diESyUQUkwq.GKCTIWb5sX9VZ6BY7J::P8kvlPSml()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0010: ldloc V_2
br IL_0062: nop
ldsfld TfxmBcbL3hCSgitew3p TfxmBcbL3hCSgitew3p::kHebc7TE6N
call System.Void TfxmBcbL3hCSgitew3p::p6rbkwMLC1(TfxmBcbL3hCSgitew3p)
ldc.i4 6
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c676f9defecf495f94df506b646682b5
brfalse IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
ret <null>
nop <null>
ldsfld j2BIFob0IEKpKXJQLej j2BIFob0IEKpKXJQLej::MRdbYm0hDU
call System.Byte[] j2BIFob0IEKpKXJQLej::p6rbkwMLC1(j2BIFob0IEKpKXJQLej)
stloc.s V_0
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_26a19161f54c4ac7b49a8dd24383258f
brtrue IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_009C: ldloc V_3
br IL_00C0: ldc.i4 1623756647
ldc.i4 1623756647
ldc.i4 1433243321
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_ecbdbba7419344f896c5c9fc03817719
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
ldc.i4 -1782268854
ldc.i4 -1984033265
xor <null>
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_8b30d55de2004820b67b12041eb7f4ba
xor <null>
ldsfld J8wfKTbbck4OoAYnFX6 J8wfKTbbck4OoAYnFX6::Ietb5OhUW9
call System.String J8wfKTbbck4OoAYnFX6::p6rbkwMLC1(System.Int32,J8wfKTbbck4OoAYnFX6)
newobj System.Void YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G::.ctor(System.String,System.String)
ldloc.s V_0
ldsfld k5kShDbvXd1lNSbeiUY k5kShDbvXd1lNSbeiUY::hogbFGNAe8
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G k5kShDbvXd1lNSbeiUY::p6rbkwMLC1(System.Object,System.Byte[],k5kShDbvXd1lNSbeiUY)
ldsfld CKYkt0besfT9r9SXTUP CKYkt0besfT9r9SXTUP::IKsbaHd6Fw
call YgTfB6iCYJIZW6VfgnF.ekYnPtik9y3NMLNdW1G CKYkt0besfT9r9SXTUP::p6rbkwMLC1(System.Object,CKYkt0besfT9r9SXTUP)
ldsfld YoWMnRbJ2l9ylTlANHh YoWMnRbJ2l9ylTlANHh::fFRbt4GyAA
call System.Void YoWMnRbJ2l9ylTlANHh::p6rbkwMLC1(System.Object,YoWMnRbJ2l9ylTlANHh)
ldc.i4 4
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_13ca1ebd3ff742df98863774c4dc7e63
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0061: ret
pop <null>
ldc.i4 0
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_dd6fa95c404f4504a706ac3d9dcd6f8b
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0177: ldloc V_1
br IL_0197: leave IL_0061
leave IL_0061: ret
ldc.i4 1
ldsfld <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28} <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_5d220cc207834204aaf998e1a3079ab9
ldfld System.Int32 <Module>{a2b0c59e-c647-495c-96cd-5afd20638b28}::m_c3481bd0fc844a9d8e7a10d11c0b0931
brtrue IL_0014: switch(IL_0062,IL_0038,IL_0061)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0038,IL_0061)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙