Malicious
Malicious

f96f3d51bc90e33d7337c221b728d8e3

PE Executable
MD5: f96f3d51bc90e33d7337c221b728d8e3
Size: 437.25 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 f96f3d51bc90e33d7337c221b728d8e3
Sha1 89e6dd11ba4b966ccc3b13a3d1e66594271f3909
Sha256 bedeb414a39ae752d21ca48b8f4be554c0be632dad235529e4aa4ae26dd50739
Sha384 46a02e83cadae7d400636b3347d880896613fcb568b35d120a359668ee51c561f681b8a30649283beafd356ab1baea08
Sha512 744a550550b13b2732b7509384edd8e7cd63fd89aff1beea2366aa917dee443a797c4b7751ba36fd83daefbd9b8b8669fe83e3107dac4b2e9284c72f218669db
SSDeep 6144:4Om95akHGzlRgYIx/ObH9AFzq5NClPlXmAPi6h:puz1ZEw/vXmAa
TLSH B294296736514E91C2894B73C1D7890087E29987B9E3F34FB18003A65D573EFE94BAA3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
f96f3d51bc90e33d7337c221b728d8e3
Malicious
.Net Resources
diNgnd1PMsp3rslHgP.cTwSn2WjXd1E8ZUgk5
KTFwWceGFbxt7w9C59.NVTwwjwOqRIaJBisPJ
CVOwGkjdemeR8dwaOt.PXsfV0KPZD5JZQZXcB
3gKMDiFqKEP7QycWik.wgapHEy6U33LokiXBw
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Zcoes.exe
Full Name
Zcoes.exe
EntryPoint
System.Void Kv4pO5NJBKkwHtsLFg.UsgCEFXTqwZSQhtVSN::DVXikPrko()
Scope Name
Zcoes.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zcoes
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Kv4pO5NJBKkwHtsLFg.UsgCEFXTqwZSQhtVSN::DVXikPrko()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0061: ret
ldsfld ALv6IBXxDSsfAdRBS97 ALv6IBXxDSsfAdRBS97::vg2Xo4DPRp
call System.Void ALv6IBXxDSsfAdRBS97::t9xXp8Ic3A(ALv6IBXxDSsfAdRBS97)
ldc.i4 1
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_92168a771a6d466c98d3b7eb62bf19fa
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld f2w8ueXQEB9luCaQbID f2w8ueXQEB9luCaQbID::v95Xk0ouL1
call System.Byte[] f2w8ueXQEB9luCaQbID::t9xXp8Ic3A(f2w8ueXQEB9luCaQbID)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_1ac877303bfd430d8c38423cf6b7376f
brfalse IL_00A0: switch(IL_00C0,IL_013C)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_013C)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_013C: leave IL_0061
ldc.i4 -439291925
ldc.i4 -702351408
sub <null>
ldc.i4 2142915696
xor <null>
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_49d142be69e0487ebf3f06c733314090
xor <null>
ldsfld LrahJmXVEcj9lcjHA2H LrahJmXVEcj9lcjHA2H::jxWX9Uy1cv
call System.String LrahJmXVEcj9lcjHA2H::t9xXp8Ic3A(System.Int32,LrahJmXVEcj9lcjHA2H)
ldc.i4 849156950
neg <null>
ldc.i4 -1223262614
xor <null>
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_ced16a70217d479d8a9340eea82f7461
xor <null>
ldsfld LrahJmXVEcj9lcjHA2H LrahJmXVEcj9lcjHA2H::jxWX9Uy1cv
call System.String LrahJmXVEcj9lcjHA2H::t9xXp8Ic3A(System.Int32,LrahJmXVEcj9lcjHA2H)
newobj System.Void FHUi3W56CIgDdGIk8R.mrccvGCpiwEZwRFX2Q::.ctor(System.String,System.String)
newobj System.Void O7Tfegyer5NS1sNSJf4.UvwSgEyWJ7MXdUboTTH::.ctor(FHUi3W56CIgDdGIk8R.mrccvGCpiwEZwRFX2Q)
ldloc.s V_2
ldsfld C6NImeX4ZtVXsoXIf8u C6NImeX4ZtVXsoXIf8u::co2XzwXpq7
call System.Void C6NImeX4ZtVXsoXIf8u::t9xXp8Ic3A(System.Object,System.Byte[],C6NImeX4ZtVXsoXIf8u)
ldc.i4 1
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_908020ca34d54f768a3f1e14fa73c737
brfalse IL_00A0: switch(IL_00C0,IL_013C)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_013C)
leave IL_0061: ret
pop <null>
ldc.i4 2
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_7b87a080798c467284e1bc092875a584
brtrue IL_0173: switch(IL_018F)
pop <null>
ldc.i4 0
br IL_0173: switch(IL_018F)
br IL_016F: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016F: ldloc V_3
br IL_018F: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_e6f739974080496d943ebded79a763e4
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
Info
PE Detect: PeReader OK (file layout)
Module Name
Zcoes.exe
Full Name
Zcoes.exe
EntryPoint
System.Void Kv4pO5NJBKkwHtsLFg.UsgCEFXTqwZSQhtVSN::DVXikPrko()
Scope Name
Zcoes.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zcoes
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void Kv4pO5NJBKkwHtsLFg.UsgCEFXTqwZSQhtVSN::DVXikPrko()
Main IL Instruction Count
97
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0061: ret
ldsfld ALv6IBXxDSsfAdRBS97 ALv6IBXxDSsfAdRBS97::vg2Xo4DPRp
call System.Void ALv6IBXxDSsfAdRBS97::t9xXp8Ic3A(ALv6IBXxDSsfAdRBS97)
ldc.i4 1
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_92168a771a6d466c98d3b7eb62bf19fa
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
ret <null>
nop <null>
ldsfld f2w8ueXQEB9luCaQbID f2w8ueXQEB9luCaQbID::v95Xk0ouL1
call System.Byte[] f2w8ueXQEB9luCaQbID::t9xXp8Ic3A(f2w8ueXQEB9luCaQbID)
stloc.s V_2
ldc.i4 0
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_1ac877303bfd430d8c38423cf6b7376f
brfalse IL_00A0: switch(IL_00C0,IL_013C)
pop <null>
ldc.i4 6
br IL_00A0: switch(IL_00C0,IL_013C)
br IL_009C: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_009C: ldloc V_0
br IL_013C: leave IL_0061
ldc.i4 -439291925
ldc.i4 -702351408
sub <null>
ldc.i4 2142915696
xor <null>
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_49d142be69e0487ebf3f06c733314090
xor <null>
ldsfld LrahJmXVEcj9lcjHA2H LrahJmXVEcj9lcjHA2H::jxWX9Uy1cv
call System.String LrahJmXVEcj9lcjHA2H::t9xXp8Ic3A(System.Int32,LrahJmXVEcj9lcjHA2H)
ldc.i4 849156950
neg <null>
ldc.i4 -1223262614
xor <null>
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_ced16a70217d479d8a9340eea82f7461
xor <null>
ldsfld LrahJmXVEcj9lcjHA2H LrahJmXVEcj9lcjHA2H::jxWX9Uy1cv
call System.String LrahJmXVEcj9lcjHA2H::t9xXp8Ic3A(System.Int32,LrahJmXVEcj9lcjHA2H)
newobj System.Void FHUi3W56CIgDdGIk8R.mrccvGCpiwEZwRFX2Q::.ctor(System.String,System.String)
newobj System.Void O7Tfegyer5NS1sNSJf4.UvwSgEyWJ7MXdUboTTH::.ctor(FHUi3W56CIgDdGIk8R.mrccvGCpiwEZwRFX2Q)
ldloc.s V_2
ldsfld C6NImeX4ZtVXsoXIf8u C6NImeX4ZtVXsoXIf8u::co2XzwXpq7
call System.Void C6NImeX4ZtVXsoXIf8u::t9xXp8Ic3A(System.Object,System.Byte[],C6NImeX4ZtVXsoXIf8u)
ldc.i4 1
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_908020ca34d54f768a3f1e14fa73c737
brfalse IL_00A0: switch(IL_00C0,IL_013C)
pop <null>
ldc.i4 3
br IL_00A0: switch(IL_00C0,IL_013C)
leave IL_0061: ret
pop <null>
ldc.i4 2
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_7b87a080798c467284e1bc092875a584
brtrue IL_0173: switch(IL_018F)
pop <null>
ldc.i4 0
br IL_0173: switch(IL_018F)
br IL_016F: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016F: ldloc V_3
br IL_018F: leave IL_0061
leave IL_0061: ret
ldc.i4 0
ldsfld <Module>{3e428046-d29e-42b4-9595-373817db73c0} <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_de93b36ddf7f4b7f8954bacf45e156ab
ldfld System.Int32 <Module>{3e428046-d29e-42b4-9595-373817db73c0}::m_e6f739974080496d943ebded79a763e4
brfalse IL_0014: switch(IL_0061,IL_0062,IL_0038)
pop <null>
ldc.i4 0
br IL_0014: switch(IL_0061,IL_0062,IL_0038)
f96f3d51bc90e33d7337c221b728d8e3
Malicious
.Net Resources
diNgnd1PMsp3rslHgP.cTwSn2WjXd1E8ZUgk5
KTFwWceGFbxt7w9C59.NVTwwjwOqRIaJBisPJ
CVOwGkjdemeR8dwaOt.PXsfV0KPZD5JZQZXcB
3gKMDiFqKEP7QycWik.wgapHEy6U33LokiXBw
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙