Malicious
Malicious

f6996d9e9f587d804b8d87d93226dfb0

PE Executable
MD5: f6996d9e9f587d804b8d87d93226dfb0
Size: 828.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
828.42 KB · 828,416 B
First seen
2026-07-28 12:01 · 3 months ago
Last seen
2026-07-28 12:01 · 3 months ago
Last analysis
2026-07-28 12:01 · 3 months ago
Hashes
MD5 f6996d9e9f587d804b8d87d93226dfb0 Sha1 5946a4df3bffa28095c867e6685e254362d8bda7 Sha256 624f9d23167fef7006ceed2413a6e491b69abfe918e07918335a90e97ffc4852 Sha384 9477b93b6ed213e892ff4cf469175b3e6234028167540bad6f5101dd62b94b4bd388d0e90c0133f54c969f3cbb65fc63 Sha512 1e0cdef77393ce8b02eb75ca6280ef1a1174ce8c43b9d070710666950b85fa5eaa08cb2a72348f5bdf6426106c8d0d8a999b86209c5497d4b483a4fd83cdc5a6 SSDeep 12288:RjgH79dTu2nLNO1+NxTYl3ROTY2Q0To1WhCAOwyV5fsvj:lw7rJN0Exs3ROTY25TEAOwyV5mj TLSH 1305BF3A32A24F21C24A1373C1D7490087D69A8726ABFB0B72C513D61D467FEDE4B697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEf6996d9e9f587d804b8d87d93226dfb0
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINVWEVbusi0rZGL6pjGM.hRoEl7AJ5ItG2pWHZ7
BINwuy6OeJidZ6JES89lt.LjmmvXrV0L99txvfoe
BINuT2Xe6vVZkvsBTSUdr.m9l9THwHITHWt5afhZ
BINjpH8jXUMJASGPp5N7V.JFAUtbEmRFxAP8RQfU
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Vlbyhi.exe
Full Name
Vlbyhi.exe
EntryPoint
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Scope Name
Vlbyhi.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vlbyhi
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0039: ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
ret <null>
ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
call System.Void W3JmiThJbt4jEqOm2DE::os4hb4VA1E(W3JmiThJbt4jEqOm2DE)
ldc.i4 5
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_b782c5c427ac42f2a7b14a4b0904b4d4
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld kP1pJUhsjxNH4AsUov3 kP1pJUhsjxNH4AsUov3::h2HhAYiX7T
call System.Byte[] kP1pJUhsjxNH4AsUov3::os4hb4VA1E(kP1pJUhsjxNH4AsUov3)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_21c2311465d74d33a75940c0c3d80db3
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2088396572
ldc.i4 2088396572
ldc.i4 857333465
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_a1a2f22ab5f6475eb663853cb5cf22f4
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
ldc.i4 -2038463597
ldc.i4 -1035395342
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4fc614624e244617995736dbb85c831b
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
newobj System.Void yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld sgumd5he4DEJKPNE89r sgumd5he4DEJKPNE89r::hPchOpJORA
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb sgumd5he4DEJKPNE89r::os4hb4VA1E(System.Object,System.Byte[],sgumd5he4DEJKPNE89r)
ldsfld LgPkhphFPjpX7jbmOKb LgPkhphFPjpX7jbmOKb::xJ9hZcqbCO
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb LgPkhphFPjpX7jbmOKb::os4hb4VA1E(System.Object,LgPkhphFPjpX7jbmOKb)
ldsfld KEmdAMhq5rqgcTiNGeb KEmdAMhq5rqgcTiNGeb::fPKhaP9Nqh
call System.Void KEmdAMhq5rqgcTiNGeb::os4hb4VA1E(System.Object,KEmdAMhq5rqgcTiNGeb)
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_738d78a92188456c932eb4629c37511c
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_475fd52dd4db486594d79ac17af09802
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4b1268d30ae14c5cbff86b3c97e4776e
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
Module Name
Vlbyhi.exe
Full Name
Vlbyhi.exe
EntryPoint
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Scope Name
Vlbyhi.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vlbyhi
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void jX1IpA1ulU4UtgZ7we.JVdCe8hvqBkcgn8KRX::s18erpma5()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0039: ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
ret <null>
ldsfld W3JmiThJbt4jEqOm2DE W3JmiThJbt4jEqOm2DE::qCthrm6jE1
call System.Void W3JmiThJbt4jEqOm2DE::os4hb4VA1E(W3JmiThJbt4jEqOm2DE)
ldc.i4 5
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_b782c5c427ac42f2a7b14a4b0904b4d4
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
nop <null>
ldsfld kP1pJUhsjxNH4AsUov3 kP1pJUhsjxNH4AsUov3::h2HhAYiX7T
call System.Byte[] kP1pJUhsjxNH4AsUov3::os4hb4VA1E(kP1pJUhsjxNH4AsUov3)
stloc.s V_2
ldc.i4 1
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_21c2311465d74d33a75940c0c3d80db3
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_0144,IL_00C0)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_00C0: ldc.i4 2088396572
ldc.i4 2088396572
ldc.i4 857333465
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_a1a2f22ab5f6475eb663853cb5cf22f4
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
ldc.i4 -2038463597
ldc.i4 -1035395342
xor <null>
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4fc614624e244617995736dbb85c831b
xor <null>
ldsfld qoOUQBhhqRe9b9blt1D qoOUQBhhqRe9b9blt1D::pmKh1yu1pa
call System.String qoOUQBhhqRe9b9blt1D::os4hb4VA1E(System.Int32,qoOUQBhhqRe9b9blt1D)
newobj System.Void yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld sgumd5he4DEJKPNE89r sgumd5he4DEJKPNE89r::hPchOpJORA
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb sgumd5he4DEJKPNE89r::os4hb4VA1E(System.Object,System.Byte[],sgumd5he4DEJKPNE89r)
ldsfld LgPkhphFPjpX7jbmOKb LgPkhphFPjpX7jbmOKb::xJ9hZcqbCO
call yRts83UcqdDFhaV7xNl.BZvNjSUbrWQfc6oOOSb LgPkhphFPjpX7jbmOKb::os4hb4VA1E(System.Object,LgPkhphFPjpX7jbmOKb)
ldsfld KEmdAMhq5rqgcTiNGeb KEmdAMhq5rqgcTiNGeb::fPKhaP9Nqh
call System.Void KEmdAMhq5rqgcTiNGeb::os4hb4VA1E(System.Object,KEmdAMhq5rqgcTiNGeb)
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_738d78a92188456c932eb4629c37511c
brfalse IL_00A0: switch(IL_0144,IL_00C0)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_0144,IL_00C0)
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_475fd52dd4db486594d79ac17af09802
brfalse IL_017B: switch(IL_0197)
pop <null>
ldc.i4 2
br IL_017B: switch(IL_0197)
br IL_0177: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0177: ldloc V_3
br IL_0197: leave IL_0038
leave IL_0038: ret
ldc.i4 0
ldsfld <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed} <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_5cfc148a397f4a559f73ce4374792eea
ldfld System.Int32 <Module>{f1db37a3-9ed0-4d22-bb80-bc5be48878ed}::m_4b1268d30ae14c5cbff86b3c97e4776e
brfalse IL_0014: switch(IL_0038,IL_0062,IL_0039)
pop <null>
ldc.i4 5
br IL_0014: switch(IL_0038,IL_0062,IL_0039)
1 malicious · 7 files
EXEf6996d9e9f587d804b8d87d93226dfb0
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙