Suspicious
Suspect

fade9fc65c0c51f683156c8296cf55a4

PE Executable
MD5: fade9fc65c0c51f683156c8296cf55a4
Size: 3.71 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 fade9fc65c0c51f683156c8296cf55a4
Sha1 4a1b639a215c8761ccb0f19a0bb3e66cb2d29592
Sha256 b22a88e0510e60d9b4c447794c67da462d73ac4e774bdff1977f8cef1b38e7b3
Sha384 d4e48ae7b9f57e381dc6e0d348ff593e4f4cb4a2e7f78b8e0b2a42b59afd49778ba93f885d630563f131df9a8e7fc68d
Sha512 171bdde27c3a66d10bbf08afa7777d816b17db5432417020f1f9cd6f37fb1bb36af949bc0f66b3d6513c011117c0dba0bec74873f66eda07828fbe7459d32229
SSDeep 49152:JS0WffMmhJWvk0L56JsVfYqAQV9jW3wQkRibLQf28Kadqn4mN8/Ei8xXErMLFvA7:k0WffRsk0Lw6KeVqpK6ld0Rit2
TLSH D406F107BB998299FE2B4F385A76470AD371F8614B66D3CF51841AE9ED537C00E29383
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
fade9fc65c0c51f683156c8296cf55a4
.Net Resources
wordmark.png
wordmark.png-preview.png
icon.png
icon.png-preview.png
font.Kanit-Medium.ttf
font.Kanit-SemiBold.ttf
font.Kanit-Bold.ttf
font.Kanit-ExtraBoldItalic.ttf
ui-bg.jpg
ui-bg.jpg-preview.png
ui-bg-dim.jpg
ui-bg-dim.jpg-preview.png
ui-logo.png
ui-logo.png-preview.png
ui-pn1.png
ui-pn1.png-preview.png
ui-pn2.png
ui-pn2.png-preview.png
ui-pn3.png
ui-pn3.png-preview.png
ui-tbplus.png
ui-tbplus.png-preview.png
ui-tile-park.jpg
ui-tile-park.jpg-preview.png
ui-tile-prio.jpg
ui-tile-prio.jpg-preview.png
ui-tile-discord.jpg
ui-tile-discord.jpg-preview.png
payload.sha256
payload.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
payload.xinput1_3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
payload.tb21.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 5 STICH kept: 1secondary ignored: 4
bin 2img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:dll
Shape pe:exe>pe:dll
2 nodes
Name Value
Module Name
TB21Launcher.exe
Full Name
TB21Launcher.exe
EntryPoint
System.Void TB21.Program::Main(System.String[])
Scope Name
TB21Launcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
TB21Launcher
Assembly Version
0.5.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1913
Main Method
System.Void TB21.Program::Main(System.String[])
Main IL Instruction Count
47
Main IL 
ldarg.0 <null>
call System.Boolean TB21.Updater::ApplyIfRequested(System.String[])
brfalse.s IL_0009: call System.String TB21.EmbeddedPayload::Ensure()
ret <null>
call System.String TB21.EmbeddedPayload::Ensure()
pop <null>
leave.s IL_0032: call System.Void TB21.Config::Load()
stloc.0 <null>
ldstr Couldn't prepare the TB21 files. 
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr TB21 Launcher
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
leave.s IL_008E: ret
call System.Void TB21.Config::Load()
ldarg.0 <null>
call System.Void TB21.LauncherShortcuts::Ensure(System.String[])
call System.String TB21.Paths::get_Payload()
ldstr tb21.ini
call System.String System.IO.Path::Combine(System.String,System.String)
call System.String System.IO.File::ReadAllText(System.String)
call System.Void TB21.Api::Configure(System.String)
ldarg.0 <null>
ldstr --shot
call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String)
brtrue.s IL_0070: ldc.i4.1
ldarg.0 <null>
ldstr --skip-update
call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String)
br.s IL_0071: stloc.1
ldc.i4.1 <null>
stloc.1 <null>
newobj System.Void System.Windows.Application::.ctor()
ldloc.1 <null>
brtrue.s IL_0082: ldarg.0
ldarg.0 <null>
newobj System.Void TB21.UpdateWindow::.ctor(System.String[])
br.s IL_0088: call System.Int32 System.Windows.Application::Run(System.Windows.Window)
ldarg.0 <null>
newobj System.Void TB21.MainWindow::.ctor(System.String[])
call System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
TB21Launcher.exe
Full Name
TB21Launcher.exe
EntryPoint
System.Void TB21.Program::Main(System.String[])
Scope Name
TB21Launcher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
TB21Launcher
Assembly Version
0.5.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1913
Main Method
System.Void TB21.Program::Main(System.String[])
Main IL Instruction Count
47
Main IL 
ldarg.0 <null>
call System.Boolean TB21.Updater::ApplyIfRequested(System.String[])
brfalse.s IL_0009: call System.String TB21.EmbeddedPayload::Ensure()
ret <null>
call System.String TB21.EmbeddedPayload::Ensure()
pop <null>
leave.s IL_0032: call System.Void TB21.Config::Load()
stloc.0 <null>
ldstr Couldn't prepare the TB21 files. 
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr TB21 Launcher
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
leave.s IL_008E: ret
call System.Void TB21.Config::Load()
ldarg.0 <null>
call System.Void TB21.LauncherShortcuts::Ensure(System.String[])
call System.String TB21.Paths::get_Payload()
ldstr tb21.ini
call System.String System.IO.Path::Combine(System.String,System.String)
call System.String System.IO.File::ReadAllText(System.String)
call System.Void TB21.Api::Configure(System.String)
ldarg.0 <null>
ldstr --shot
call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String)
brtrue.s IL_0070: ldc.i4.1
ldarg.0 <null>
ldstr --skip-update
call System.Boolean System.Linq.Enumerable::Contains<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.String)
br.s IL_0071: stloc.1
ldc.i4.1 <null>
stloc.1 <null>
newobj System.Void System.Windows.Application::.ctor()
ldloc.1 <null>
brtrue.s IL_0082: ldarg.0
ldarg.0 <null>
newobj System.Void TB21.UpdateWindow::.ctor(System.String[])
br.s IL_0088: call System.Int32 System.Windows.Application::Run(System.Windows.Window)
ldarg.0 <null>
newobj System.Void TB21.MainWindow::.ctor(System.String[])
call System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
ret <null>
fade9fc65c0c51f683156c8296cf55a4
.Net Resources
wordmark.png
wordmark.png-preview.png
icon.png
icon.png-preview.png
font.Kanit-Medium.ttf
font.Kanit-SemiBold.ttf
font.Kanit-Bold.ttf
font.Kanit-ExtraBoldItalic.ttf
ui-bg.jpg
ui-bg.jpg-preview.png
ui-bg-dim.jpg
ui-bg-dim.jpg-preview.png
ui-logo.png
ui-logo.png-preview.png
ui-pn1.png
ui-pn1.png-preview.png
ui-pn2.png
ui-pn2.png-preview.png
ui-pn3.png
ui-pn3.png-preview.png
ui-tbplus.png
ui-tbplus.png-preview.png
ui-tile-park.jpg
ui-tile-park.jpg-preview.png
ui-tile-prio.jpg
ui-tile-prio.jpg-preview.png
ui-tile-discord.jpg
ui-tile-discord.jpg-preview.png
payload.sha256
payload.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
payload.xinput1_3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.reloc
payload.tb21.ini
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
ID:0008
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙