Malicious
Malicious

f512184d11309e3da83fa1967d3faff6

Share on LinkedIn
Print
PE Executable
MD5: f512184d11309e3da83fa1967d3faff6
Size: 567.81 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f512184d11309e3da83fa1967d3faff6
Sha1 91508be084b889c9fc08e8ab54dfe60fb8b013ba
Sha256 bd296ff393a98cde9f95de9a44567fdae94f40b55a6d1f02d58b8e58f0ff7f2d
Sha384 a29373bc4cffac17a5297d9f322a81e542e521289835d86a3cd8f03eecef1b3154f26c95958bb763d7257d6a21f705da
Sha512 1c4f25f71c4e16a2dfb0a7026f31053aee0809689759cfab1a8d43d47764b23f0f25ff8b4b077bc9c14e453b1e5112582a57320fbb999fa754416f2021be8950
SSDeep 12288:qJJkhZSTx3Wvxlt20j/bOxlmqAcX66pAON98:qJD3WL3RqAp6pAw
TLSH FEC47D273A924E51C5950F77C0DB950083A6A686F9E3F30F728427692D133FEDA4B693
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f512184d11309e3da83fa1967d3faff6
Malicious
.Net Resources
9t66gD6357LEa8V7f3.VYfcleZUPsiEAHPorO
neYQYQXiN4LSl4ioYe.6J75NhPE24ESpPCgVi
NPnpgYryMM1CvsbiOJ.t1ZkRG7vEM30JHbh3G
BTPb4vFvF9v0M3cnBi.t4OLfRDZMCoxrTQxuu
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Rxjztu.exe
Full Name
Rxjztu.exe
EntryPoint
System.Void Y98Sml873D7vX1aXmM.RNXifYgtukHWuIQufw::uj5a7FhHY()
Scope Name
Rxjztu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rxjztu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Y98Sml873D7vX1aXmM.RNXifYgtukHWuIQufw::uj5a7FhHY()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld HFIpavgepQbiWsNv9Zn HFIpavgepQbiWsNv9Zn::mnSgMSuHj8
call System.Byte[] HFIpavgepQbiWsNv9Zn::aFAgGO6GQp(HFIpavgepQbiWsNv9Zn)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_20094f7dc7a3422fa6388dde773e2351
brtrue IL_0077: switch(IL_0097,IL_0113)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0097,IL_0113)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0113: leave IL_0038
ldc.i4 795871864
not <null>
ldc.i4 -1467015805
xor <null>
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_b6a4aa1f9258479f9d6f55248c736dab
xor <null>
ldsfld rmRIwFg398GhKK3OHPQ rmRIwFg398GhKK3OHPQ::IKeg2b1aWT
call System.String rmRIwFg398GhKK3OHPQ::aFAgGO6GQp(System.Int32,rmRIwFg398GhKK3OHPQ)
ldc.i4 1184884226
ldc.i4 -1648719587
xor <null>
ldc.i4 -1760352164
xor <null>
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_0e06d872ae88464b8330e8d40c004952
xor <null>
ldsfld rmRIwFg398GhKK3OHPQ rmRIwFg398GhKK3OHPQ::IKeg2b1aWT
call System.String rmRIwFg398GhKK3OHPQ::aFAgGO6GQp(System.Int32,rmRIwFg398GhKK3OHPQ)
newobj System.Void pJ7VSATacOFs8ANlJw.DVpIWvvJsJQqEBDpx3::.ctor(System.String,System.String)
newobj System.Void C86frBD6clAKx96BD8P.o1KXp0DP7dMHIdfsOJb::.ctor(pJ7VSATacOFs8ANlJw.DVpIWvvJsJQqEBDpx3)
ldloc.s V_3
ldsfld IBBCDlgKgpBJaHXF0i1 IBBCDlgKgpBJaHXF0i1::x2ggzrTugF
call System.Void IBBCDlgKgpBJaHXF0i1::aFAgGO6GQp(System.Object,System.Byte[],IBBCDlgKgpBJaHXF0i1)
ldc.i4 1
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_7c41ab0894ca46c9914ae9aa217f68df
brtrue IL_0077: switch(IL_0097,IL_0113)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0097,IL_0113)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_73bb29c0f14d4dc0a83dd1dc58cd81a2
brfalse IL_014A: switch(IL_0166)
pop <null>
ldc.i4 0
br IL_014A: switch(IL_0166)
br IL_0146: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0146: ldloc V_1
br IL_0166: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_d08084c842814c7ab56e97f84ad54203
brtrue IL_0014: switch(IL_0038,IL_0039,IL_018A)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_018A)
ldsfld JvM922giAuZfol0pSec JvM922giAuZfol0pSec::Kldgo7V9Sj
call System.Void JvM922giAuZfol0pSec::aFAgGO6GQp(JvM922giAuZfol0pSec)
ldc.i4 4
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_986541cd3ffb40d0a1d61be1942a95b0
brfalse IL_0014: switch(IL_0038,IL_0039,IL_018A)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_018A)
Info
PE Detect: PeReader OK (file layout)
Module Name
Rxjztu.exe
Full Name
Rxjztu.exe
EntryPoint
System.Void Y98Sml873D7vX1aXmM.RNXifYgtukHWuIQufw::uj5a7FhHY()
Scope Name
Rxjztu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rxjztu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Y98Sml873D7vX1aXmM.RNXifYgtukHWuIQufw::uj5a7FhHY()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 990
beq IL_0010: ldloc V_0
br IL_0039: nop
ret <null>
nop <null>
ldsfld HFIpavgepQbiWsNv9Zn HFIpavgepQbiWsNv9Zn::mnSgMSuHj8
call System.Byte[] HFIpavgepQbiWsNv9Zn::aFAgGO6GQp(HFIpavgepQbiWsNv9Zn)
stloc.s V_3
ldc.i4 0
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_20094f7dc7a3422fa6388dde773e2351
brtrue IL_0077: switch(IL_0097,IL_0113)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0097,IL_0113)
br IL_0073: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0073: ldloc V_2
br IL_0113: leave IL_0038
ldc.i4 795871864
not <null>
ldc.i4 -1467015805
xor <null>
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_b6a4aa1f9258479f9d6f55248c736dab
xor <null>
ldsfld rmRIwFg398GhKK3OHPQ rmRIwFg398GhKK3OHPQ::IKeg2b1aWT
call System.String rmRIwFg398GhKK3OHPQ::aFAgGO6GQp(System.Int32,rmRIwFg398GhKK3OHPQ)
ldc.i4 1184884226
ldc.i4 -1648719587
xor <null>
ldc.i4 -1760352164
xor <null>
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_0e06d872ae88464b8330e8d40c004952
xor <null>
ldsfld rmRIwFg398GhKK3OHPQ rmRIwFg398GhKK3OHPQ::IKeg2b1aWT
call System.String rmRIwFg398GhKK3OHPQ::aFAgGO6GQp(System.Int32,rmRIwFg398GhKK3OHPQ)
newobj System.Void pJ7VSATacOFs8ANlJw.DVpIWvvJsJQqEBDpx3::.ctor(System.String,System.String)
newobj System.Void C86frBD6clAKx96BD8P.o1KXp0DP7dMHIdfsOJb::.ctor(pJ7VSATacOFs8ANlJw.DVpIWvvJsJQqEBDpx3)
ldloc.s V_3
ldsfld IBBCDlgKgpBJaHXF0i1 IBBCDlgKgpBJaHXF0i1::x2ggzrTugF
call System.Void IBBCDlgKgpBJaHXF0i1::aFAgGO6GQp(System.Object,System.Byte[],IBBCDlgKgpBJaHXF0i1)
ldc.i4 1
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_7c41ab0894ca46c9914ae9aa217f68df
brtrue IL_0077: switch(IL_0097,IL_0113)
pop <null>
ldc.i4 2
br IL_0077: switch(IL_0097,IL_0113)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_73bb29c0f14d4dc0a83dd1dc58cd81a2
brfalse IL_014A: switch(IL_0166)
pop <null>
ldc.i4 0
br IL_014A: switch(IL_0166)
br IL_0146: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0146: ldloc V_1
br IL_0166: leave IL_0038
leave IL_0038: ret
ldc.i4 3
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_d08084c842814c7ab56e97f84ad54203
brtrue IL_0014: switch(IL_0038,IL_0039,IL_018A)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0038,IL_0039,IL_018A)
ldsfld JvM922giAuZfol0pSec JvM922giAuZfol0pSec::Kldgo7V9Sj
call System.Void JvM922giAuZfol0pSec::aFAgGO6GQp(JvM922giAuZfol0pSec)
ldc.i4 4
ldsfld <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb} <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_bc2f4f2f511b4ce5ab4fcda4fba74464
ldfld System.Int32 <Module>{626f7795-f25d-4c9d-ba87-0f14b8336fdb}::m_986541cd3ffb40d0a1d61be1942a95b0
brfalse IL_0014: switch(IL_0038,IL_0039,IL_018A)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0039,IL_018A)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙