Malicious
Malicious

f6996d9e9f587d804b8d87d93226dfb0

PE Executable
MD5: f6996d9e9f587d804b8d87d93226dfb0
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f6996d9e9f587d804b8d87d93226dfb0
Sha1 5946a4df3bffa28095c867e6685e254362d8bda7
Sha256 624f9d23167fef7006ceed2413a6e491b69abfe918e07918335a90e97ffc4852
Sha384 9477b93b6ed213e892ff4cf469175b3e6234028167540bad6f5101dd62b94b4bd388d0e90c0133f54c969f3cbb65fc63
Sha512 1e0cdef77393ce8b02eb75ca6280ef1a1174ce8c43b9d070710666950b85fa5eaa08cb2a72348f5bdf6426106c8d0d8a999b86209c5497d4b483a4fd83cdc5a6
SSDeep 12288:RjgH79dTu2nLNO1+NxTYl3ROTY2Q0To1WhCAOwyV5fsvj:lw7rJN0Exs3ROTY25TEAOwyV5mj
TLSH 1305BF3A32A24F21C24A1373C1D7490087D69A8726ABFB0B72C513D61D467FEDE4B697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f6996d9e9f587d804b8d87d93226dfb0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VWEVbusi0rZGL6pjGM.hRoEl7AJ5ItG2pWHZ7
wuy6OeJidZ6JES89lt.LjmmvXrV0L99txvfoe
uT2Xe6vVZkvsBTSUdr.m9l9THwHITHWt5afhZ
jpH8jXUMJASGPp5N7V.JFAUtbEmRFxAP8RQfU
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Vlbyhi.exe
Full Name
Vlbyhi.exe
EntryPoint
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Scope Name
Vlbyhi.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vlbyhi
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0039: ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
ret <null>
ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
call System.Void W3JmiThJbt4jEqOm2DE::os4hb4VA1E(W3JmiThJbt4jEqOm2DE)
ldc.i4 5
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_b782c5c427ac42f2a7b14a4b0904b4d4
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld kP1pJUhsjxNH4AsUov3 kP1pJUhsjxNH4AsUov3::h2HhAYiX7T
call System.Byte[] kP1pJUhsjxNH4AsUov3::os4hb4VA1E(kP1pJUhsjxNH4AsUov3)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_21c2311465d74d33a75940c0c3d80db3
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2088396572
ldc.i4 2088396572
ldc.i4 857333465
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_a1a2f22ab5f6475eb663853cb5cf22f4
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
ldc.i4 -2038463597
ldc.i4 -1035395342
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4fc614624e244617995736dbb85c831b
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
newobj System.Void yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld sgumd5he4DEJKPNE89r sgumd5he4DEJKPNE89r::hPchOpJORA
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb sgumd5he4DEJKPNE89r::os4hb4VA1E(System.Object,System.Byte[],sgumd5he4DEJKPNE89r)
ldsfld LgPkhphFPjpX7jbmOKb LgPkhphFPjpX7jbmOKb::xJ9hZcqbCO
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb LgPkhphFPjpX7jbmOKb::os4hb4VA1E(System.Object,LgPkhphFPjpX7jbmOKb)
ldsfld KEmdAMhq5rqgcTiNGeb KEmdAMhq5rqgcTiNGeb::fPKhaP9Nqh
call System.Void KEmdAMhq5rqgcTiNGeb::os4hb4VA1E(System.Object,KEmdAMhq5rqgcTiNGeb)
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_738d78a92188456c932eb4629c37511c
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_475fd52dd4db486594d79ac17af09802
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4b1268d30ae14c5cbff86b3c97e4776e
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Vlbyhi.exe
Full Name
Vlbyhi.exe
EntryPoint
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Scope Name
Vlbyhi.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vlbyhi
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0039: ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
ret <null>
ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
call System.Void W3JmiThJbt4jEqOm2DE::os4hb4VA1E(W3JmiThJbt4jEqOm2DE)
ldc.i4 5
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_b782c5c427ac42f2a7b14a4b0904b4d4
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld kP1pJUhsjxNH4AsUov3 kP1pJUhsjxNH4AsUov3::h2HhAYiX7T
call System.Byte[] kP1pJUhsjxNH4AsUov3::os4hb4VA1E(kP1pJUhsjxNH4AsUov3)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_21c2311465d74d33a75940c0c3d80db3
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2088396572
ldc.i4 2088396572
ldc.i4 857333465
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_a1a2f22ab5f6475eb663853cb5cf22f4
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
ldc.i4 -2038463597
ldc.i4 -1035395342
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4fc614624e244617995736dbb85c831b
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
newobj System.Void yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld sgumd5he4DEJKPNE89r sgumd5he4DEJKPNE89r::hPchOpJORA
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb sgumd5he4DEJKPNE89r::os4hb4VA1E(System.Object,System.Byte[],sgumd5he4DEJKPNE89r)
ldsfld LgPkhphFPjpX7jbmOKb LgPkhphFPjpX7jbmOKb::xJ9hZcqbCO
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb LgPkhphFPjpX7jbmOKb::os4hb4VA1E(System.Object,LgPkhphFPjpX7jbmOKb)
ldsfld KEmdAMhq5rqgcTiNGeb KEmdAMhq5rqgcTiNGeb::fPKhaP9Nqh
call System.Void KEmdAMhq5rqgcTiNGeb::os4hb4VA1E(System.Object,KEmdAMhq5rqgcTiNGeb)
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_738d78a92188456c932eb4629c37511c
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_475fd52dd4db486594d79ac17af09802
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4b1268d30ae14c5cbff86b3c97e4776e
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
f6996d9e9f587d804b8d87d93226dfb0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VWEVbusi0rZGL6pjGM.hRoEl7AJ5ItG2pWHZ7
wuy6OeJidZ6JES89lt.LjmmvXrV0L99txvfoe
uT2Xe6vVZkvsBTSUdr.m9l9THwHITHWt5afhZ
jpH8jXUMJASGPp5N7V.JFAUtbEmRFxAP8RQfU
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙