Suspicious
Suspect

f7d8cd211e82f28a4ed52e1eef63a924

PE Executable
MD5: f7d8cd211e82f28a4ed52e1eef63a924
Size: 222.21 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 f7d8cd211e82f28a4ed52e1eef63a924
Sha1 a0c93473e81e9a37cc58fdc92f270a45b6898149
Sha256 255ef1d6f1da0b68446f349349d966c43ecbc96dca378836b9cc37abc013d671
Sha384 26cb151fd9a4f81b35734ceb4e105d135ea91fd576fd1057b0b617623e4a5b42540adab8505ce59f98a4b5669fcd13f8
Sha512 68a0acc7329577a599e8bcace8684b7f64aa054548de06898fd8aefbef2daaf54160dc9ba7a868434d59ef735a9949b0c218c086eb9a058d369f361eaa263e5f
SSDeep 3072:spi9gspoKv2ayRbgn7lBW3Q/eb+/DE9LnC0eM+lmsolAIrRuw+mqv9j1MWLQ6:O+oKv2HCT/eboY9zf9+lDAA
TLSH 4B24C5E5B740C464C86B497A843796A7A473E64E9C289A5E38C1FF1B3D7334B441BC8B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f7d8cd211e82f28a4ed52e1eef63a924
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Mm.exe
Full Name
Mm.exe
EntryPoint
System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
Scope Name
Mm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mm
Assembly Version
9.0.1.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
Main IL Instruction Count
127
Main IL 
ldsfld System.Int32 BqNZvkXY0KWjpKDyv5HqTlwW::NMK8902DJtDXoTKhTgKBiaZd
ldc.i4 1000
mul.ovf <null>
ldc.i4 572
ldc.i4 587
call System.Void Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴐ(System.Int32,System.Int32,System.Int16)
ldc.i4.6 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::9nZvt75wI6QW8jz2tT59qFRT
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 267
ldc.i4 271
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::9nZvt75wI6QW8jz2tT59qFRT
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::VLmSIDYrffGnqh4gjPinl4Gj
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 225
ldc.i4 229
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::VLmSIDYrffGnqh4gjPinl4Gj
ldc.i4.2 <null>
stloc.s V_4
br.s IL_001D: ldloc.s V_4
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::SN1roJhhRspqZGam7Nqz2slz
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 329
ldc.i4 333
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::SN1roJhhRspqZGam7Nqz2slz
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::680YcyU2CIX4xaXKXXfJuIOW
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 978
ldc.i4 982
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::680YcyU2CIX4xaXKXXfJuIOW
ldc.i4.5 <null>
stloc.s V_4
br IL_001D: ldloc.s V_4
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::JvKhhcyHzOQBx6JCan3dmCdM
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 880
ldc.i4 884
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::JvKhhcyHzOQBx6JCan3dmCdM
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::e9drlsZuVkg1y2lPSBji1Mwi
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 254
ldc.i4 250
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::e9drlsZuVkg1y2lPSBji1Mwi
leave.s IL_0135: ldc.i4.8
dup <null>
ldc.i4 944
ldc.i4 1000
call System.Void My.Pi90ldxjFBfavKjoStDYTw5aSMYnazIoxto9cg73Bdkf3lYm8::Ⴗ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4 270
ldc.i4 374
call System.Void Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴐ(System.Int32,System.Int32,System.Int16)
ldc.i4 430
ldc.i4 414
call System.Void My.Pi90ldxjFBfavKjoStDYTw5aSMYnazIoxto9cg73Bdkf3lYm8::Ⴐ(System.Char,System.Int16)
leave.s IL_0135: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴓ.Ⴀ::Ⴄ()
brtrue.s IL_016F: ldc.i4.7
ldc.i4.4 <null>
stloc.s V_6
br.s IL_0138: ldloc.s V_6
ldc.i4.7 <null>
br.s IL_016B: stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::Ox6yxcPltYeTqOpTSv6aHYMO()
call System.Void Ⴓ.Ⴀ::Ⴗ()
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::MvoJmr0OJ1qYMVBbVwAl9iqL()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::fyihpciOQ43VZu6hUyidUatf()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_6
br.s IL_0138: ldloc.s V_6
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::XqeDzdd1Xqoxx2IMmzVoxTOl()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.6 <null>
stloc.s V_6
br IL_0138: ldloc.s V_6
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 304
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 304
ldelem.u2 <null>
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 182
ldelem.u2 <null>
xor <null>
ldc.i4 248
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
pop <null>
ret <null>
Module Name
Mm.exe
Full Name
Mm.exe
EntryPoint
System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
Scope Name
Mm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Mm
Assembly Version
9.0.1.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
Main IL Instruction Count
127
Main IL 
ldsfld System.Int32 BqNZvkXY0KWjpKDyv5HqTlwW::NMK8902DJtDXoTKhTgKBiaZd
ldc.i4 1000
mul.ovf <null>
ldc.i4 572
ldc.i4 587
call System.Void Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴐ(System.Int32,System.Int32,System.Int16)
ldc.i4.6 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::9nZvt75wI6QW8jz2tT59qFRT
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 267
ldc.i4 271
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::9nZvt75wI6QW8jz2tT59qFRT
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::VLmSIDYrffGnqh4gjPinl4Gj
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 225
ldc.i4 229
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::VLmSIDYrffGnqh4gjPinl4Gj
ldc.i4.2 <null>
stloc.s V_4
br.s IL_001D: ldloc.s V_4
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::SN1roJhhRspqZGam7Nqz2slz
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 329
ldc.i4 333
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::SN1roJhhRspqZGam7Nqz2slz
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::680YcyU2CIX4xaXKXXfJuIOW
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 978
ldc.i4 982
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::680YcyU2CIX4xaXKXXfJuIOW
ldc.i4.5 <null>
stloc.s V_4
br IL_001D: ldloc.s V_4
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::JvKhhcyHzOQBx6JCan3dmCdM
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 880
ldc.i4 884
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::JvKhhcyHzOQBx6JCan3dmCdM
ldsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::e9drlsZuVkg1y2lPSBji1Mwi
call System.Object Stub.aWT4Iv9v5XqrGJ10O6h0uUHfZ25O7JphUyx8152uiT9hsW3itfvWgOKed3m::doKXeyjQunQuNTNMZcnSU7oZ0slsyupm4E7pAcGf11rToiZYhQAI1k7RBez(System.String)
ldc.i4 254
ldc.i4 250
call System.String Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴗ<System.Object>(System.Object,System.Int16,System.Char)
stsfld System.String BqNZvkXY0KWjpKDyv5HqTlwW::e9drlsZuVkg1y2lPSBji1Mwi
leave.s IL_0135: ldc.i4.8
dup <null>
ldc.i4 944
ldc.i4 1000
call System.Void My.Pi90ldxjFBfavKjoStDYTw5aSMYnazIoxto9cg73Bdkf3lYm8::Ⴗ<System.Exception>(System.Exception,System.Int16,System.Char)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4 270
ldc.i4 374
call System.Void Stub.qkDX4YbV0KGdk7scKCYo5eOEyKeGQw68Wi6Fe2083/ႷႤ::Ⴐ(System.Int32,System.Int32,System.Int16)
ldc.i4 430
ldc.i4 414
call System.Void My.Pi90ldxjFBfavKjoStDYTw5aSMYnazIoxto9cg73Bdkf3lYm8::Ⴐ(System.Char,System.Int16)
leave.s IL_0135: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_6
ldloc.s V_6
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴓ.Ⴀ::Ⴄ()
brtrue.s IL_016F: ldc.i4.7
ldc.i4.4 <null>
stloc.s V_6
br.s IL_0138: ldloc.s V_6
ldc.i4.7 <null>
br.s IL_016B: stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::Ox6yxcPltYeTqOpTSv6aHYMO()
call System.Void Ⴓ.Ⴀ::Ⴗ()
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::MvoJmr0OJ1qYMVBbVwAl9iqL()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::fyihpciOQ43VZu6hUyidUatf()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldc.i4.5 <null>
stloc.s V_6
br.s IL_0138: ldloc.s V_6
ldnull <null>
ldftn System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::XqeDzdd1Xqoxx2IMmzVoxTOl()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.6 <null>
stloc.s V_6
br IL_0138: ldloc.s V_6
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 304
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 304
ldelem.u2 <null>
ldsfld System.Char[] My.z4PxPza4C2s41Ao9PLdfUSxKlm8KPMnzSRzavw4xZmBJdC::Ⴈ
ldc.i4 182
ldelem.u2 <null>
xor <null>
ldc.i4 248
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Stub.IwepNjUUIYwmhmCKF9ubtlV5::7k5041tnRaGFDCvxEfIxHD1X()
pop <null>
ret <null>
f7d8cd211e82f28a4ed52e1eef63a924
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙